openapi: 3.1.0
info:
  version: latest
  title: Spectra Intelligence OpenAPI Specification
  description: |-
    ReversingLabs Spectra Intelligence offers REST web services providing file reputation, file analysis, malware hunting and network indicator information. These can be used for incident response triage, malware analysis, threat intelligence augmentation, and other uses. The output format of API results is either XML or JSON. All requests addressed to ReversingLabs Spectra Intelligence must use the `https` protocol. 

    ### Authorization

    All requests to ReversingLabs Spectra Intelligence services require the HTTP `Authorization` header with basic authentication (example: `Authorization Basic {base64-encoded username:password}`). The code examples use `username` and `password` as placeholders - replace them with your own information. If the authorization header is not provided in the request, the services will respond with status 401.
  contact:
    name: ReversingLabs
    email: support@reversinglabs.com
  license:
    name: ReversingLabs End-User Software License Agreement
    url: https://fileshare.reversinglabs.com/index.php/s/DHqAcBiyBxB2Hz6
servers:
  - url: https://data.reversinglabs.com
    description: Spectra Intelligence server
tags:
  - name: File Threat Intelligence
    description: <p style="font-weight:bold; font-style:italic; ">Get file reputation insights from ReversingLabs</p>
  - name: Certificate Threat Intelligence
    description: <p style="font-weight:bold; font-style:italic; ">Get file certificate insights from ReversingLabs</p>
  - name: Network Threat Intelligence
    description: <p style="font-weight:bold; font-style:italic; ">Find files in Spectra Intelligence using network indicator metadata</p>
  - name: Automation
    description: <p style="font-weight:bold; font-style:italic; ">Manage files in Spectra Intelligence</p>
  - name: Dynamic Analysis (ReversingLabs Cloud Sandbox)
    description: <p style="font-weight:bold; font-style:italic; ">Detonate files in  ReversingLabs Cloud Sandbox and retrieve reports</p>
  - name: Malware Hunting
    description: <p style="font-weight:bold; font-style:italic; ">Look up various malware types by multiple criteria</p>
  - name: Supply Chain Security
    description: <p style="font-weight:bold; font-style:italic; ">Programmatically interact with the Spectra Assure Community platform</p>
  - name: Customer Administration & Usage
    description: <p style="font-weight:bold; font-style:italic; ">Monitor your usage of ReversingLabs Spectra Intelligence services</p>
  - name: Malicious File Indicators
    description: <p style="font-weight:bold; font-style:italic; ">Get file threat intelligence</p>
  - name: Certificate Indicators
    description: <p style="font-weight:bold; font-style:italic; ">Find out more about certificates used to sign files</p>
  - name: Network Indicators
    description: <p style="font-weight:bold; font-style:italic; ">Inspect IP addresses, URLs, and emails linked to malware</p>
  - name: CVE and In-the-Wild Exploits
    description: <p style="font-weight:bold; font-style:italic; ">List detected CVEs and exploits</p>
  - name: Whitelist File Indicators
    description: <p style="font-weight:bold; font-style:italic; ">Obtain lists of currently or previously whitelisted files</p>
  - name: Targeted and Industry-Specific Indicators
    description: <p style="font-weight:bold; font-style:italic; ">Explore specialized types of malware</p>
externalDocs:
  url: https://docs.reversinglabs.com/SpectraIntelligence/
  description: Complete documentation
paths:
  /api/databrowser/malware_presence/query/{hash_type}/{hash_value}:
    get:
      summary: 'TCA-0101: File Reputation (single query)'
      tags:
        - File Threat Intelligence
      operationId: get-api-databrowser-malware_presence-query-hash_type-hash_value
      parameters:
        - $ref: '#/components/parameters/HashType'
        - $ref: '#/components/parameters/HashValue'
        - $ref: '#/components/parameters/ResponseFormat'
        - name: extended
          in: query
          schema:
            type: boolean
            default: false
            example: true
          description: Optional parameter that specifies whether additional classification metadata for the requested sample should be returned in the response. Additional metadata includes information such as trust factor and threat level values; malware type, family name, and platform; first and last seen times, and more. If the parameter is not provided in the request, the default value is `false` (additional metadata is not returned).
        - name: show_hashes
          in: query
          schema:
            type: boolean
            default: false
            example: true
          description: Optional parameter that specifies whether MD5, SHA1, and SHA256 hashes should be returned in the response for the requested sample, in addition to the rest of the Malware Presence information. If the parameter is not provided in the request, the default value is `false` (hashes are not returned).
      description: 'The File Reputation (Malware Presence) API provides file reputation status calculated by a proprietary ReversingLabs algorithm for the requested sample. The status can be: MALICIOUS, SUSPICIOUS, KNOWN (non-malicious or benign), UNKNOWN. Additional classification-related metadata and hashes can be requested using optional parameters. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      malware_presence:
                        status: KNOWN
                        query_hash:
                          sha1: 2cfbb1d2ee28644934bbd3baf6a6667905eee27b
                        sha1: 2cfbb1d2ee28644934bbd3baf6a6667905eee27b
                        md5: c8ef05f345b61d4892496b1f8ddae78c
                        sha256: 624200f51a513c05cdcb948649367f725953da9753a23e7f62861eabdb1f79c9
                        first_seen: '2017-08-06T19:56:25'
                        last_seen: '2024-12-12T09:38:10'
                        reason: best_source
                        trust_factor: 0
                        threat_level: 0
                        scanner_count: 38
                        scanner_match: 0
                        scanner_percent: 0
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      malware_presence:
                        type: object
                        properties:
                          status:
                            type: string
                          sha1:
                            type: string
                          threat_level:
                            type: number
                          scanner_percent:
                            type: number
                          scanner_match:
                            type: number
                          last_seen:
                            type: string
                          reason:
                            type: string
                          scanner_count:
                            type: number
                          query_hash:
                            type: object
                            properties:
                              sha1:
                                type: string
                            required:
                              - sha1
                          first_seen:
                            type: string
                          sha256:
                            type: string
                          trust_factor:
                            type: number
                          md5:
                            type: string
                        required:
                          - status
                          - sha1
                          - threat_level
                          - scanner_percent
                          - scanner_match
                          - last_seen
                          - reason
                          - scanner_count
                          - query_hash
                          - first_seen
                          - sha256
                          - trust_factor
                          - md5
                    required:
                      - malware_presence
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/databrowser/malware_presence/query/sha1/2cfbb1d2ee28644934bbd3baf6a6667905eee27b?extended=true&show_hashes=true&format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/databrowser/malware_presence/query/sha1/2cfbb1d2ee28644934bbd3baf6a6667905eee27b?extended=true&show_hashes=true&format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters: []
  /api/databrowser/malware_presence/bulk_query/{post_format}:
    post:
      summary: 'TCA-0101: File Reputation (bulk query)'
      tags:
        - File Threat Intelligence
      operationId: post-api-databrowser-malware_presence-bulk_query-post_format
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - $ref: '#/components/parameters/ResponseBulk'
        - name: extended
          in: query
          schema:
            type: boolean
            default: false
            example: true
          description: Optional parameter that specifies whether additional classification metadata for the requested sample should be returned in the response. Additional metadata includes information such as trust factor and threat level values; malware type, family name, and platform; first and last seen times, and more. If the parameter is not provided in the request, the default value is `false` (additional metadata is not returned).
        - name: show_hashes
          in: query
          schema:
            type: boolean
            default: false
            example: true
          description: Optional parameter that specifies whether MD5, SHA1, and SHA256 hashes should be returned in the response for the requested sample, in addition to the rest of the Malware Presence information. If the parameter is not provided in the request, the default value is `false` (hashes are not returned).
      description: 'The File Reputation (Malware Presence) Bulk API provides file reputation status calculated by a proprietary ReversingLabs algorithm for the requested samples. Up to 100 hashes can be submitted in one request. The status can be: MALICIOUS, SUSPICIOUS, KNOWN (non-malicious or benign), UNKNOWN. Additional classification-related metadata and hashes can be requested using optional parameters. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      entries:
                        - status: KNOWN
                          query_hash:
                            sha1: b363713a938afcd3c74603827fab79e935b2b09b
                        - status: UNKNOWN
                          query_hash:
                            sha1: ca03064987d3c4465f91552ba8b6a883eecfd3e5
                        - status: KNOWN
                          query_hash:
                            sha1: a7afddb68260a60f86c02a021efba7f216c2e7cf
                      invalid_hashes:
                        - example_of_a_wrong_hash
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - invalid_hashes
                      - entries
                    properties:
                      invalid_hashes:
                        type: array
                        items:
                          type: object
                      entries:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          type: object
                          properties:
                            status:
                              type: string
                              minLength: 5
                              enum:
                                - KNOWN
                                - UNKNOWN
                                - SUSPICIOUS
                                - MALICIOUS
                              example: UNKNOWN
                            query_hash:
                              type: object
                              properties:
                                sha1:
                                  type: string
                              required:
                                - sha1
                          required:
                            - status
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/RequestTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/databrowser/malware_presence/bulk_query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b",
                    "example_of_a_wrong_hash"
                  ]
                }
              }
            }'
        - lang: Python
          source: |
            import requests
            import json
            url = "https://data.reversinglabs.com/api/databrowser/malware_presence/bulk_query/json?format=json"
            json = {
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b",
                    "example_of_a_wrong_hash"
                  ]
                }
              }
            }
            response = requests.post(url, auth=('username', 'password'), json=json)
            print(response.text)
      requestBody:
        $ref: '#/components/requestBodies/BulkRequest'
  /api/databrowser/malware_presence/user_override/{post_format}:
    post:
      summary: 'TCA-0102: File Reputation Override'
      tags:
        - File Threat Intelligence
      operationId: post-api-databrowser-malware_presence-user_override-post_format
      parameters:
        - name: post_format
          in: path
          schema:
            type: string
            enum:
              - xml
              - json
          required: true
          description: Required parameter that defines the POST payload format. Supported options are **xml** and **json**.
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The File Reputation Override (Malware Presence) API enables file reputation status override for the requested samples. Up to 100 hashes can be submitted in one request. The status can be: MALICIOUS, SUSPICIOUS, or KNOWN (non-malicious or benign). Additional classification-related metadata and can be specified using optional parameters. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      user_override:
                        create_override:
                          - sha1: 9865c7ecda437034e1513cc43ae9a1f6f334bb7f
                            md5: 294c7e5ecdc3e94c6ea3f5a7c9ccc581
                            sha256: 3cdbba0294d51b060436952e23dcf6243dd53e52a7b41bf60ee90583f27bc4ea
                            status: KNOWN
                            trust_factor: 3
                          - sha1: 2cfbb1d2ee28644934bbd3baf6a6667905eee27b
                            md5: c8ef05f345b61d4892496b1f8ddae78c
                            sha256: 624200f51a513c05cdcb948649367f725953da9753a23e7f62861eabdb1f79c9
                            status: MALICIOUS
                            threat_name: Win32.Backdoor.Bifrost
                            threat_level: 2
                        remove_override:
                          - sha1: 00000aae8c7a59999e156524a8d6fd35009f4275
                            md5: 77459f04fde5c9945ed57508bfe54922
                            sha256: c88f99d08545143779123578804d71e83db8c0dfeb00284b646e3a3982568034
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - user_override
                    properties:
                      user_override:
                        properties:
                          create_override:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              required:
                                - sha1
                                - md5
                                - sha256
                                - status
                              properties:
                                sha1:
                                  type: string
                                  example: 9865c7ecda437034e1513cc43ae9a1f6f334bb7f
                                md5:
                                  type: string
                                  example: 294c7e5ecdc3e94c6ea3f5a7c9ccc581
                                sha256:
                                  type: string
                                  example: 3cdbba0294d51b060436952e23dcf6243dd53e52a7b41bf60ee90583f27bc4ea
                                status:
                                  type: string
                                  enum:
                                    - KNOWN
                                    - MALICIOUS
                                    - SUSPICIOUS
                                trust_factor:
                                  type: integer
                                threat_level:
                                  type: integer
                                threat_name:
                                  type: string
                                  example: Win32.Backdoor.Bifrost
                          replace_override:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              required:
                                - sha1
                                - md5
                                - sha256
                                - status
                              properties:
                                sha1:
                                  type: string
                                  example: 9865c7ecda437034e1513cc43ae9a1f6f334bb7f
                                md5:
                                  type: string
                                  example: 294c7e5ecdc3e94c6ea3f5a7c9ccc581
                                sha256:
                                  type: string
                                  example: 3cdbba0294d51b060436952e23dcf6243dd53e52a7b41bf60ee90583f27bc4ea
                                status:
                                  type: string
                                  enum:
                                    - KNOWN
                                    - MALICIOUS
                                    - SUSPICIOUS
                                trust_factor:
                                  type: integer
                                threat_level:
                                  type: integer
                                threat_name:
                                  type: string
                                  example: Win32.Backdoor.Bifrost
                          remove_override:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              required:
                                - sha1
                                - md5
                                - sha256
                              properties:
                                sha1:
                                  type: string
                                  example: 9865c7ecda437034e1513cc43ae9a1f6f334bb7f
                                md5:
                                  type: string
                                  example: 294c7e5ecdc3e94c6ea3f5a7c9ccc581
                                sha256:
                                  type: string
                                  example: 3cdbba0294d51b060436952e23dcf6243dd53e52a7b41bf60ee90583f27bc4ea
                required:
                  - rl
        '400':
          description: Bad Request. The request could not be understood by the server due to malformed syntax. If the request doesn't adhere to above structure or some value is invalid, more information will be available in the response body.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/RequestTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      requestBody:
        description: '`override_samples` is an array of samples to override. Each sample must be defined by `sha1`, `md5`, and `sha256`, and include new `status` for those hashes and may include `threat_name`, `threat_level` and `trust_factor` depending on the `status` value. `remove_override` is an array of samples which already have an override that should be removed. Each sample must be defined by `sha1`, `md5` and `sha256`. Up to 100 hashes can be submitted in one request.'
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - rl
              properties:
                rl:
                  type: object
                  required:
                    - query
                  properties:
                    query:
                      type: object
                      properties:
                        override_samples:
                          type: array
                          items:
                            type: object
                            required:
                              - sha1
                              - md5
                              - sha256
                              - status
                            properties:
                              sha1:
                                type: string
                                example: 9865c7ecda437034e1513cc43ae9a1f6f334bb7f
                              md5:
                                type: string
                                example: 294c7e5ecdc3e94c6ea3f5a7c9ccc581
                              sha256:
                                type: string
                                example: 3cdbba0294d51b060436952e23dcf6243dd53e52a7b41bf60ee90583f27bc4ea
                              status:
                                type: string
                                enum:
                                  - KNOWN
                                  - MALICIOUS
                                  - SUSPICIOUS
                              trust_factor:
                                type: integer
                              threat_level:
                                type: integer
                              threat_name:
                                type: string
                                example: Win32.Backdoor.Bifrost
                        remove_override:
                          type: array
                          items:
                            type: object
                            required:
                              - sha1
                              - md5
                              - sha256
                            properties:
                              sha1:
                                type: string
                                example: 9865c7ecda437034e1513cc43ae9a1f6f334bb7f
                              md5:
                                type: string
                                example: 294c7e5ecdc3e94c6ea3f5a7c9ccc581
                              sha256:
                                type: string
                                example: 3cdbba0294d51b060436952e23dcf6243dd53e52a7b41bf60ee90583f27bc4ea
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/databrowser/malware_presence/user_override/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "override_samples": [
                            {
                                "sha1": "0000000000000000000000000000000000000001",
                                "md5": "00000000000000000000000000000001",
                                "sha256": "0000000000000000000000000000000000000000000000000000000000000001",
                                "status": "KNOWN",
                                "trust_factor": 3
                            },
                            {
                                "sha1": "0000000000000000000000000000000000000002",
                                "md5": "00000000000000000000000000000002",
                                "sha256": "0000000000000000000000000000000000000000000000000000000000000002",
                                "status": "MALICIOUS",
                                "threat_level": 3,
                                "threat_name": "Win32.Backdoor.Bifrost"
                            }
                        ],
                        "remove_override": [
                            {
                                "sha1": "0000000000000000000000000000000000000003",
                                "md5": "00000000000000000000000000000003",
                                "sha256": "0000000000000000000000000000000000000000000000000000000000000003"
                            }
                        ]
                    }
                }
            }'
        - lang: Python
          source: |
            import requests
            import json
            url = "https://data.reversinglabs.com/api/databrowser/malware_presence/user_override/json"
            json = {
                "rl": {
                    "query": {
                        "override_samples": [
                            {
                                "sha1": "0000000000000000000000000000000000000001",
                                "md5": "00000000000000000000000000000001",
                                "sha256": "0000000000000000000000000000000000000000000000000000000000000001",
                                "status": "KNOWN",
                                "trust_factor": 3
                            },
                            {
                                "sha1": "0000000000000000000000000000000000000002",
                                "md5": "00000000000000000000000000000002",
                                "sha256": "0000000000000000000000000000000000000000000000000000000000000002",
                                "status": "MALICIOUS",
                                "threat_level": 3,
                                "threat_name": "Win32.Backdoor.Bifrost"
                            }
                        ],
                        "remove_override": [
                            {
                                "sha1": "0000000000000000000000000000000000000003",
                                "md5": "00000000000000000000000000000003",
                                "sha256": "0000000000000000000000000000000000000000000000000000000000000003"
                            }
                        ]
                    }
                }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)
            print(response.text)
  /api/databrowser/malware_presence/user_override/list_hashes/{hash_type}:
    get:
      summary: 'TCA-0102: File Reputation Override (list)'
      tags:
        - File Threat Intelligence
      operationId: get-api-databrowser-malware_presence-user_override-list_hashes
      parameters:
        - name: hash_type
          in: path
          schema:
            type: string
            enum:
              - sha1
              - md5
              - sha256
          required: true
          description: Required parameter that defines the type of hash to be returned.
        - name: start_hash
          in: query
          schema:
            type: string
            example:
              - 9865c7ecda437034e1513cc43ae9a1f6f334bb7f
          description: Optional parameter that specified the first hash in the response to be returned. Enables pagination.
        - $ref: '#/components/parameters/ResponseFormat'
        - name: extended
          in: query
          schema:
            type: boolean
            default: false
          description: Optional parameter. When set to `true`, the response uses an extended format in which `rl.user_override.hash_values` is an array of objects containing hash values and classification metadata instead of an array of hash strings. In this case, the `hash_type` parameter only affects the type of the `next_hash` value; each entry contains all hash types (`sha1`, `md5`, `sha256`).
      description: The File Reputation Override (list) API lists all existing file reputation status overrides for the requested user. The hashes are sorted. Up to 1000 hashes will be returned. If there are more than 1000 active overrides, `next_hash` value in the previous response may be provided as the `start_hash` of the subsequent request to enumerate all hashes. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      user_override:
                        hash_values:
                          - 066555b967516408b70a588235edc2beac84ac39bddb050c739ace024f905aa3
                          - 066a8f4ca87b6f4403280473d2a40adcaa6199290382c3363c268652c4e61b1a
                          - 06922cf986e8ac45a6f207025a3a5fead0e286b3e00e84d24ce41b634e966033
                          - fdfe17edacf8f77359c45ce368189ed24c3203673b5977610587a019f2ebb63d
                          - ff490786b1cf50f92cea53aaa31fd0abe528f8c23e06320537ccecf494e5a4c3
                        next_hash: null
              schema:
                description: ''
                type: object
                required:
                  - rl
                properties:
                  rl:
                    type: object
                    required:
                      - hash_values
                      - next_hash
                    properties:
                      hash_values:
                        oneOf:
                          - type: array
                            uniqueItems: true
                            items:
                              type: string
                              example: 9865c7ecda437034e1513cc43ae9a1f6f334bb7f
                          - type: array
                            items:
                              type: object
                              properties:
                                sha1:
                                  type: string
                                md5:
                                  type: string
                                sha256:
                                  type: string
                                status:
                                  type: string
                                  enum:
                                    - MALICIOUS
                                    - SUSPICIOUS
                                    - KNOWN
                                threat_level:
                                  type: integer
                                  minimum: 1
                                  maximum: 5
                                threat_name:
                                  type: string
                                trust_factor:
                                  type: integer
                                  minimum: 0
                                  maximum: 5
                      next_hash:
                        type:
                          - string
                          - 'null'
                        example: 9865c7ecda437034e1513cc43ae9a1f6f334bb7f
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/RequestTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/databrowser/malware_presence/user_override/list_hashes/sha1?start_hash=9865c7ecda437034e1513cc43ae9a1f6f334bb7f&format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/databrowser/malware_presence/user_override/list_hashes/sha1?start_hash=9865c7ecda437034e1513cc43ae9a1f6f334bb7f&format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/xref/v2/query/{hash_type}/{hash_value}:
    get:
      summary: 'TCA-0103: Historic Multi-AV Scan Records (single query)'
      tags:
        - File Threat Intelligence
      operationId: get-api-xref-v2-query-hash_type-hash_value
      parameters:
        - $ref: '#/components/parameters/HashType'
        - $ref: '#/components/parameters/HashValue'
        - $ref: '#/components/parameters/ResponseFormat'
        - name: history
          in: query
          schema:
            type: boolean
            default: false
            example: true
          description: Optional parameter that defines whether the response should contain a history of XREF records for a sample (when `true`) or the latest record only (when `false`). The default is `false`.
      description: The Historic Multi-AV Scan Records (XREF) API provides cross-reference data (AV scanner scanning information, first and last seen date-time (UTC), sample type and size, first and last scanned date, etc.) for the requested sample. An optional parameter `history` can be used in requests to this API to retrieve historical XREF record changes for the sample (if available).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      sample:
                        sha1: 7d8f177243cfa055c95cbbf32ebc2d7e8c71d4fb
                        md5: e196466d4597bef92404f73892db5606
                        sha256: 000e2bd65848674562b615696a28f2cb3ed974a3600dbfa52da1c6240bef4e76
                        sha384: 23e0bf3a284ae10edfbc5f155eb9effa92678be7eae67bc68dd6f4cb99f4f458a2cb986ba6035fb24d14aa65ab7efb35
                        sha512: e9f7d04c903d28fe00a99aa2043ac9172e4c1a8d6a6c2bc06d8bd7fd656c1aeb613659a24eaf76f00553696a964529b50262214632c55138c5aa11a5b4e66b45
                        ripemd160: 76a939882589b74cab5ff136f5724ae075c6496a
                        sample_type: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
                        sample_size: 417792
                        single_scan: false
                        first_seen_on: '2013-10-26T17:55:00'
                        last_seen_on: '2023-12-22T07:22:00'
                        first_scanned_on: '2013-10-26T17:55:00'
                        last_scanned_on: '2023-12-22T07:22:00'
                        xref:
                          - scanner_match: 7
                            scanner_count: 23
                            scanned_on: '2023-12-22T07:22:00'
                            scanners:
                              - name: ''
                                version: ''
                                timestamp: '2023-12-22T04:55:00'
                              - name: ''
                                version: ''
                                timestamp: '2023-12-22T05:45:00'
                              - name: ''
                                version: ''
                                timestamp: '2023-12-22T06:50:00'
                            results:
                              - scanner: ''
                                result: ''
                              - scanner: ''
                                result: ''
                              - scanner: ''
                                result: ''
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      sample:
                        type: object
                        properties:
                          sha1:
                            type: string
                          first_seen_on:
                            type: string
                          last_scanned_on:
                            type: string
                          last_seen_on:
                            type: string
                          single_scan:
                            type: boolean
                          first_scanned_on:
                            type: string
                          sample_type:
                            type: string
                          sample_size:
                            type: number
                          xref:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - scanner_match
                                - scanner_count
                                - scanned_on
                              properties:
                                scanner_match:
                                  type: number
                                scanner_count:
                                  type: number
                                scanners:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - timestamp
                                      - version
                                      - name
                                    properties:
                                      timestamp:
                                        type: string
                                      version:
                                        type: string
                                      name:
                                        type: string
                                scanned_on:
                                  type: string
                                results:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - scanner
                                      - result
                                    properties:
                                      scanner:
                                        type: string
                                      result:
                                        type: string
                          sha384:
                            type: string
                          sha256:
                            type: string
                          sha512:
                            type: string
                          ripemd160:
                            type: string
                          md5:
                            type: string
                        required:
                          - sha1
                          - first_seen_on
                          - last_scanned_on
                          - last_seen_on
                          - single_scan
                          - first_scanned_on
                          - sample_type
                          - sample_size
                          - xref
                          - sha384
                          - sha256
                          - sha512
                          - ripemd160
                          - md5
                    required:
                      - sample
                required:
                  - rl
        '400':
          description: Invalid username / Invalid hash value / Invalid hash type / Parsing error description / Unknown POST format / Empty request
        '401':
          description: User not found / User not authorized
        '403':
          description: User disabled / User not allowed
        '404':
          description: Sample not found / Missing XREF for the sample
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/xref/v2/query/sha1/7d8f177243cfa055c95cbbf32ebc2d7e8c71d4fb?format=json&history=true' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/xref/v2/query/sha1/7d8f177243cfa055c95cbbf32ebc2d7e8c71d4fb?format=json&history=true"

            response = requests.get(url, auth=('username', 'password'))

            print(response.text)
  /api/xref/v2/bulk_query/{post_format}:
    post:
      summary: 'TCA-0103: Historic Multi-AV Scan Records (bulk query)'
      tags:
        - File Threat Intelligence
      operationId: post-api-xref-v2-bulk_query-post_format
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - $ref: '#/components/parameters/ResponseBulk'
        - name: history
          in: query
          schema:
            type: boolean
            default: false
            example: true
          description: Optional parameter that defines whether the response should contain a history of XREF records for a sample (when `true`) or the latest record only (when `false`). The default is `false`.
      description: 'The Historic Multi-AV Scan Records Bulk API provides cross-reference data (AV scanner scanning information, first and last seen date-time (UTC), sample type and size, first and last scanned date, etc.) for up to 100 requested samples. An optional parameter `history` can be used in requests to this API to retrieve historical XREF record changes for each sample (if available). '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      samples:
                        - sha1: a7afddb68260a60f86c02a021efba7f216c2e7cf
                          md5: ecae13117d6f0584c25a9da6c8f8415e
                          sha256: 3316348dbadfb7b11c7c2ea235949419e23f9fa898ad2c198f999617912a9925
                          sha384: ec635fbf3c47a97bf33fc24fe6ee7b04da172537ad8eb01885f29432614c433398789505277ed350ad56648af98c207e
                          sha512: ee021c5aa94c55f1dbbe287200618d386799f21ce4e35af71c9e7474267ebaf5fde5436ea44d689c8abd9dbb24e76da9493f982453cad987d1ca003f9eb9ef34
                          ripemd160: 3f756169279d4a50ee2931f653a1020c39951235
                          sample_type: ASCII text, with no line terminators
                          sample_size: 4
                          single_scan: false
                          first_seen_on: '2013-12-14T07:53:00'
                          last_seen_on: '2025-01-10T11:12:00'
                          first_scanned_on: '2013-12-14T07:53:00'
                          last_scanned_on: '2025-01-10T11:12:00'
                          xref:
                            - scanner_match: 0
                              scanner_count: 38
                              scanned_on: '2025-01-10T11:12:00'
                              scanners:
                                - name: ''
                                  version: ''
                                  timestamp: '2025-01-10T10:45:00'
                                - name: ''
                                  version: ''
                                  timestamp: '2025-01-10T10:45:00'
                                - name: ''
                                  version: ''
                                  timestamp: '2025-01-10T10:56:00'
                              results:
                                - scanner: ''
                                  result: ''
                                - scanner: ''
                                  result: ''
                                - scanner: ''
                                  result: ''
                        - sha1: b363713a938afcd3c74603827fab79e935b2b09b
                          md5: 3c78b35502b2693fefdfc51cba3a53a5
                          sha256: 36bde66f289a35683683b041c6d8f418a5f36607b547da25d00ad55891e80b88
                          sha384: ce5d21c271776c88490850cad79c5794f7822165e402cf0abde2be1b5ebeb4e988eee6d9ce22ea06babe7ee3233e2c94
                          sha512: 58941c13ad37895a59ef321bbac1c4818734c0ea305cee3eaab38b3d3ee90005843c334eff1a6d1f4bf9f90c0f1d458dac833ed24a9153761935d355fb0dbef6
                          ripemd160: 1f0e050f8570a9e4a99ad38ef05903efac03db37
                          sample_type: ASCII text, with no line terminators
                          sample_size: 6
                          single_scan: false
                          first_seen_on: '2018-05-29T05:53:41'
                          last_seen_on: '2025-01-10T11:04:00'
                          first_scanned_on: '2018-05-29T06:11:00'
                          last_scanned_on: '2025-01-10T11:04:00'
                          xref:
                            - scanner_match: 0
                              scanner_count: 38
                              scanned_on: '2025-01-10T11:04:00'
                              scanners:
                                - name: ''
                                  version: ''
                                  timestamp: '2025-01-10T10:45:00'
                                - name: ''
                                  version: ''
                                  timestamp: '2025-01-10T10:45:00'
                                - name: ''
                                  version: ''
                                  timestamp: '2025-01-10T10:56:00'
                              results:
                                - scanner: ''
                                  result: ''
                                - scanner: ''
                                  result: ''
                                - scanner: ''
                                  result: ''
                      unknown_hashes:
                        - ca03064987d3c4465f91552ba8b6a883eecfd3e5
                      invalid_hashes:
                        - example_of_a_wrong_hash
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      samples:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - sha1
                            - first_seen_on
                            - last_scanned_on
                            - last_seen_on
                            - single_scan
                            - first_scanned_on
                            - sample_type
                            - sample_size
                            - sha384
                            - sha256
                            - sha512
                            - ripemd160
                            - md5
                          properties:
                            sha1:
                              type: string
                            first_seen_on:
                              type: string
                            last_scanned_on:
                              type: string
                            last_seen_on:
                              type: string
                            single_scan:
                              type: boolean
                            first_scanned_on:
                              type: string
                            sample_type:
                              type: string
                            sample_size:
                              type: number
                            xref:
                              type: array
                              uniqueItems: true
                              minItems: 1
                              items:
                                required:
                                  - scanner_match
                                  - scanner_count
                                  - scanned_on
                                properties:
                                  scanner_match:
                                    type: number
                                  scanner_count:
                                    type: number
                                  scanners:
                                    type: array
                                    uniqueItems: true
                                    minItems: 1
                                    items:
                                      required:
                                        - timestamp
                                        - version
                                        - name
                                      properties:
                                        timestamp:
                                          type: string
                                        version:
                                          type: string
                                        name:
                                          type: string
                                  scanned_on:
                                    type: string
                                  results:
                                    type: array
                                    uniqueItems: true
                                    minItems: 1
                                    items:
                                      required:
                                        - scanner
                                        - result
                                      properties:
                                        scanner:
                                          type: string
                                        result:
                                          type: string
                            sha384:
                              type: string
                            sha256:
                              type: string
                            sha512:
                              type: string
                            ripemd160:
                              type: string
                            md5:
                              type: string
                      unknown_hashes:
                        type: array
                        items:
                          required: []
                          properties: {}
                      invalid_hashes:
                        type: array
                        items:
                          required: []
                          properties: {}
                    required:
                      - samples
                      - unknown_hashes
                      - invalid_hashes
                required:
                  - rl
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: The server understood the request, but is refusing to fulfill it. The user account that sent the request is disabled.
        '404':
          $ref: '#/components/responses/NotFound'
        '405':
          description: Method Not Allowed
        '413':
          $ref: '#/components/responses/RequestTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/xref/v2/bulk_query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b"
                  ]
                }
              }
            }'
        - lang: Python
          source: |
            import requests
            import json
            url = "https://data.reversinglabs.com/api/xref/v2/bulk_query/json"
            json = {
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b",
                    "example_of_a_wrong_hash"
                  ]
                }
              }
            }
            response = requests.post(url, auth=('username', 'password'), json=json)
            print(response.text)
      requestBody:
        $ref: '#/components/requestBodies/BulkRequest'
  /api/databrowser/rldata/query/{hash_type}/{hash_value}:
    get:
      summary: 'TCA-0104: File Analysis - Hash (single query)'
      tags:
        - File Threat Intelligence
      operationId: get-api-databrowser-rldata-query-hash_type-hash_value
      parameters:
        - $ref: '#/components/parameters/HashType'
        - $ref: '#/components/parameters/HashValue'
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The File Analysis - Hash [RLDATA] API provides analysis results for the requested hash. The extent of analysis data returned in the response varies based on the file type. Note that the dynamic analysis report is only available with additional permissions. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      sample:
                        sha1: ed4800dcf00527000a7aad254625df5ac1b78781
                        md5: fcd541a7e549c585bb0f4bfa90af52a9
                        sha256: 6ecd6595f66a1e09f6197d991a33f56383948ac5d883d34819e4d5ce93556ef5
                        sha384: e7108be5aef817b2542334c23a0761b7b4f25246db44466e4bc0066deda621fe16f396b8804ea1fdab726b515f9d121c
                        sha512: 157a4a07b7e6655f208a0cd37621df8b4285b422523e9274463eac130be743377187e532a3671f392e2a7191145347aa89115e9e281955c7a961575bd25a3ec4
                        ripemd160: 0955288526bc3ccdbe3c6abcc83682610ba0829b
                        ssdeep: 24:oDZ+mCbj/CSUQEX1hXVLPP+5TN4t4j1SzsTjdcCll51:rR/JUQEFhl7P++t4jUzECCt1
                        tlsh: T13A11E9DF8723989FA2F219B394273094DA5B7AD9F020563349134C921E0B19DA77E544
                        sample_size: 1085
                        relationships:
                          container_sample_sha1:
                            - ed4800dcf00527000a7aad254625df5ac1b78781
                        analysis:
                          entries:
                            - record_time: '2025-01-15T13:26:37'
                              analysis_type: TC_REPORT
                              analysis_version: 3.0.1
                              tc_report:
                                info:
                                  file:
                                    file_type: Image
                                    file_subtype: None
                                  identification:
                                    name: PNG
                        xref:
                          entries:
                            - record_time: '2025-01-15T13:42:00'
                              scanners:
                                - name: ''
                                  result: ''
                                - name: ''
                                  result: ''
                                - name: ''
                                  result: ''
                              info:
                                scanners:
                                  - name: ''
                                    version: ''
                                    timestamp: '2025-01-15T09:47:00'
                                  - name: ''
                                    version: ''
                                    timestamp: '2025-01-15T09:47:00'
                                  - name: ''
                                    version: ''
                                    timestamp: '2025-01-15T11:50:00'
                          first_seen: '2025-01-15T13:23:44'
                          last_seen: '2025-01-15T13:42:00'
                          sample_type: PNG image data, 510 x 510, 1-bit grayscale, non-interlaced
                        computer_vision_analysis:
                          entries:
                            - analysis_time: '2025-02-27T10:14:11'
                              results:
                                - format: QR_CODE
                                  category: domain
                                  value: master.dl.sourceforge.net
                                - format: QR_CODE
                                  category: https
                                  value: https://master.dl.sourceforge.net/project/mad-thought/mad-thought/2.0/mad-thought-2.0.tar.gz
                        sources:
                          entries:
                            - record_time: '2025-01-15T13:23:44'
                              tag: reversing_labs
                              properties:
                                - name: file_name
                                  value: a100065a5a71766e7e3cbe7332fbabc5294ee294.png
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      sample:
                        type: object
                        properties:
                          sha1:
                            type: string
                          md5:
                            type: string
                          sha256:
                            type: string
                          sha384:
                            type: string
                          sha512:
                            type: string
                          ripemd160:
                            type: string
                          ssdeep:
                            type: string
                          tlsh:
                            type: string
                          sample_size:
                            type: number
                          relationships:
                            type: object
                            properties:
                              container_sample_sha1:
                                type: array
                                items:
                                  required: []
                                  properties: {}
                            required:
                              - container_sample_sha1
                          analysis:
                            type: object
                            properties:
                              entries:
                                type: array
                                uniqueItems: true
                                minItems: 1
                                items:
                                  required:
                                    - record_time
                                    - analysis_type
                                    - analysis_version
                                  properties:
                                    record_time:
                                      type: string
                                    analysis_type:
                                      type: string
                                    analysis_version:
                                      type: string
                                    tc_report:
                                      type: object
                                      properties:
                                        info:
                                          type: object
                                          properties:
                                            file:
                                              type: object
                                              properties:
                                                file_type:
                                                  type: string
                                                file_subtype:
                                                  type: string
                                                proposed_filename:
                                                  type: string
                                              required:
                                                - file_type
                                                - file_subtype
                                            identification:
                                              type: object
                                              properties:
                                                name:
                                                  type: string
                                              required:
                                                - name
                                            validation:
                                              type: string
                                            package:
                                              type: object
                                          required:
                                            - file
                                            - identification
                                        metadata:
                                          type: object
                                          properties:
                                            application:
                                              type: array
                                            certificate:
                                              type: array
                                            attack:
                                              type: object
                                              properties:
                                                attack_tactics:
                                                  type: array
                                                attack_techniques:
                                                  type: array
                                            software_packages:
                                              type: object
                                              properties:
                                                unique_id:
                                                  type: string
                                                name:
                                                  type: string
                                                description:
                                                  type: string
                                                authors:
                                                  type: array
                                                release_dependencies:
                                                  type: array
                                                develop_dependencies:
                                                  type: array
                                        interesting_strings:
                                          type: array
                                          uniqueItems: true
                                          minItems: 1
                                          items:
                                            required:
                                              - category
                                            properties:
                                              category:
                                                type: string
                                              values:
                                                type: array
                                                items:
                                                  required: []
                                                  properties: {}
                                        story:
                                          type: string
                                          minLength: 1
                                        indicators:
                                          type: array
                                          description: List of indicators. Indicators are human-readable descriptions of file intent.
                                          items:
                                            type: object
                                            properties:
                                              priority:
                                                type: number
                                              category:
                                                type: number
                                              description:
                                                type: string
                                              id:
                                                type: number
                                              relevance:
                                                type: number
                                      required:
                                        - info
                            required:
                              - entries
                          xref:
                            type: object
                            properties:
                              entries:
                                type: array
                                uniqueItems: true
                                minItems: 1
                                items:
                                  required:
                                    - record_time
                                  properties:
                                    record_time:
                                      type: string
                                    scanners:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required:
                                          - name
                                          - result
                                        properties:
                                          name:
                                            type: string
                                          result:
                                            type: string
                                    info:
                                      type: object
                                      properties:
                                        scanners:
                                          type: array
                                          uniqueItems: true
                                          minItems: 1
                                          items:
                                            required:
                                              - name
                                              - version
                                              - timestamp
                                            properties:
                                              name:
                                                type: string
                                              version:
                                                type: string
                                              timestamp:
                                                type: string
                                      required:
                                        - scanners
                              first_seen:
                                type: string
                              last_seen:
                                type: string
                              sample_type:
                                type: string
                            required:
                              - entries
                              - first_seen
                              - last_seen
                              - sample_type
                          sources:
                            type: object
                            properties:
                              entries:
                                type: array
                                uniqueItems: true
                                minItems: 1
                                items:
                                  required:
                                    - record_time
                                    - tag
                                  properties:
                                    record_time:
                                      type: string
                                    tag:
                                      type: string
                                    properties:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required:
                                          - name
                                          - value
                                        properties:
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    domain:
                                      type: object
                                      properties:
                                        name:
                                          type: string
                                      required:
                                        - name
                            required:
                              - entries
                          computer_vision_analysis:
                            type: object
                            properties:
                              entries:
                                type: array
                                uniqueItems: true
                                minItems: 1
                                items:
                                  required:
                                    - analysis_time
                                    - results
                                  properties:
                                    analysis_time:
                                      type: string
                                    results:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required:
                                          - format
                                          - category
                                          - value
                                        properties:
                                          format:
                                            type: string
                                            enum:
                                              - QR_CODE
                                              - OCR
                                          category:
                                            type: string
                                            enum:
                                              - mailto
                                              - ipv4
                                              - domain
                                              - ipv6
                                              - http
                                              - https
                                              - ftp
                                              - nfs
                                              - file
                                              - gopher
                                              - ldap
                                              - prospero
                                              - net.pipe
                                              - net.tcp
                                              - news
                                              - nntp
                                              - telnet
                                              - uuid
                                              - wais
                                          value:
                                            type: string
                        required:
                          - sha1
                          - md5
                          - sha256
                          - sha384
                          - sha512
                          - ripemd160
                          - ssdeep
                          - tlsh
                          - sample_size
                          - relationships
                          - analysis
                          - xref
                          - sources
                    required:
                      - sample
                required:
                  - rl
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/databrowser/rldata/query/sha1/a45ab18fb7a06dd5ecb44bf6c221a951f974059f?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/databrowser/rldata/query/sha1/a45ab18fb7a06dd5ecb44bf6c221a951f974059f?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/databrowser/rldata/bulk_query/{post_format}:
    post:
      summary: 'TCA-0104: File Analysis - Hash (bulk query)'
      tags:
        - File Threat Intelligence
      operationId: post-api-databrowser-rldata-bulk_query-post_format
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - $ref: '#/components/parameters/ResponseBulk'
      description: The File Analysis - Hash [RLDATA] Bulk API provides analysis results for up to 100 requested hashes in a single response. The extent of analysis data returned in the response varies based on the file type. Note that the dynamic analysis report is only available with additional permissions. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      entries:
                        - sha1: a7afddb68260a60f86c02a021efba7f216c2e7cf
                          crc32: '98574167'
                          md5: ecae13117d6f0584c25a9da6c8f8415e
                          sha256: 3316348dbadfb7b11c7c2ea235949419e23f9fa898ad2c198f999617912a9925
                          sha384: ec635fbf3c47a97bf33fc24fe6ee7b04da172537ad8eb01885f29432614c433398789505277ed350ad56648af98c207e
                          sha512: ee021c5aa94c55f1dbbe287200618d386799f21ce4e35af71c9e7474267ebaf5fde5436ea44d689c8abd9dbb24e76da9493f982453cad987d1ca003f9eb9ef34
                          ripemd160: 3f756169279d4a50ee2931f653a1020c39951235
                          sample_size: 4
                          relationships:
                            container_sample_sha1:
                              - 9a6dfa1158a3a5594d828cc54aecb3adf25b0791
                              - fd52de404c18d73f37353bb7d74266e9226a7b4c
                              - 62b295dd94a5f3a53ff6bb902c397103b8519b1e
                              - e2d89992d3ce90e7f15a22a5957fdd135e8e7058
                              - a455b1144988f4e1ddafd2a9a3af49aeefa10515
                            parent_sample_sha1:
                              - 11b6af9a3f58ad692fe958eb11044ebf53b0a79d
                              - 99dba7e826df697e57d4f0a2b623dce07b4fcd51
                              - bf312aa0765083f71f0d12a5eb96589d5fe03887
                              - 9b9872f7f45da560975806a921c0a5578ef439cf
                              - c70b0d518b5e4fe215a8b07eaeed3a49b4fe1a77
                          analysis:
                            entries:
                              - record_time: '2024-04-07T21:23:23'
                                analysis_type: TC_REPORT
                                analysis_version: 3.7.1.0
                                tc_report:
                                  info:
                                    file:
                                      file_type: Text
                                      file_subtype: None
                                  metadata:
                                    certificate:
                                      signer_info:
                                        version: 0
                                        issuer: ''
                                        serial_number: ''
                                        digest_algorithm: ''
                                        digest_encrypt_algorithm: ''
                                        encrypted_digest: ''
                          xref:
                            entries:
                              - record_time: '2025-01-10T11:12:00'
                                scanners:
                                  - name: ''
                                    result: ''
                                  - name: ''
                                    result: ''
                                  - name: ''
                                    result: ''
                                info:
                                  scanners:
                                    - name: ''
                                      version: ''
                                      timestamp: '2025-01-10T10:45:00'
                                    - name: ''
                                      version: ''
                                      timestamp: '2025-01-10T10:45:00'
                                    - name: ''
                                      version: ''
                                      timestamp: '2025-01-10T10:56:00'
                            first_seen: '2013-12-14T07:53:00'
                            last_seen: '2025-01-10T11:12:00'
                            sample_type: ASCII text, with no line terminators
                          sources:
                            entries:
                              - record_time: '2024-08-20T01:38:20'
                                tag: reversing_labs
                                properties:
                                  - name: url
                                    value: https://www.scholae.co/web/read/2695/landasan.teknologi.pendidikan.dan.pembelajaran
                                  - name: file_name
                                    value: landasan.teknologi.pendidikan.dan.pembelajaran
                                  - name: request_sequence_urls
                                    value: https://www.scholae.co/web/read/2695/landasan.teknologi.pendidikan.dan.pembelajaran
                                domain:
                                  name: scholae.co
                              - record_time: '2023-12-02T09:54:15'
                                tag: reversing_labs
                              - record_time: '2019-10-05T13:15:22'
                                tag: reversing_labs
                                properties:
                                  - name: file_type
                                    value: ASCII text, with no line terminators
                                  - name: file_name
                                    value: screenshot.txt
                                  - name: malware
                                    value: 'false'
                                domain:
                                  name: mydiv.net
                              - record_time: '2016-10-30T05:15:44'
                                tag: microsoft_whitelist
                                properties:
                                  - name: filename
                                    value: word.txt
                                domain:
                                  name: microsoft.com
                              - record_time: '2015-12-03T01:23:22'
                                tag: reversing_labs
                              - record_time: '2014-08-27T00:50:40'
                                tag: reversing_labs
                          dynamic_analysis:
                            entries:
                              - dynamic_analysis_report_joe_sandbox:
                                  network:
                                    dns_requests:
                                      - type: '33'
                                        query: _VLMCS._TCP.example.org
                                      - type: '33'
                                        query: _ldap._tcp.dc._msdcs.WORKGROUP.example.org
                                    domains:
                                      - ip: unknown
                                        name: _VLMCS._TCP.example.org
                                      - ip: unknown
                                        name: _ldap._tcp.dc._msdcs.WORKGROUP.example.org
                                    udp_destinations:
                                      - port: 50023
                                        address: 192.168.2.152
                                      - port: 57994
                                        address: 192.168.2.152
                                      - port: 53
                                        address: 8.8.8.8
                                  joe_sandbox_version: 34.0.0
                                  analysed_on: '2025-01-10T11:21:23'
                        - sha1: 06e6da0dbae4b2fa9d319ff73cd2c40530b1cd7a
                          crc32: cc4ed4b0
                          md5: 2cacc04b03aea0df5ae1b65bb5f50a2d
                          sha256: 24d7cf4a2594c6914cbca2bc36d39d61732e8fb62fa37ee9bde6b11b77992414
                          sha384: 2978282e30fc39a0b2478a61db0e2e61f2d6f3c4d88dd73d33686c1d8b458275dc667458ca09aa70ba774f08ac51beea
                          sha512: 380b03af73d69b7d3ca6d0fcb81473de994b345f53b437ffab882c539dfb0c3b1cb0d04ebbf20da6c721308d188089be752523875461df64fc9d0bcaa7efbeb8
                          ripemd160: 5c476a7aead0e61655b20086ba52f0c38e3932e2
                          ssdeep: 48:mDy/ICEovolJT00xxIv7qUaaxIQbTgqP5Nox:muCW4xITHaaeQ/gqPk
                          sample_size: 4264
                          password_uploaded: true
                          relationships:
                            container_sample_sha1:
                              - e0923956dd4127a7b2c15e209be714896a4df76a
                              - 1291e4f1201f10fec2ba8ee2d76ee39fc2abecc4
                              - 7edca0d4cb3454991cdc96b8948fa45a40e0cbf5
                              - a95dd384cd80fa660269e0176cb999cdbfbcd461
                              - 63b2eb68178e11663f5064bbe36d944a385fef32
                            parent_sample_sha1:
                              - 05b1b6b374946520141ecab652fc0688f28903ea
                              - 872cccd67d272a0dfa4cf6f055e4babf8197696f
                              - 892a1eac9450fc44579adb9cc05742eb35565157
                              - aca5b716e89f669882ff3469084149cc8c620e9f
                              - e32aaaaf4a3ea4cd84fadedf3ad38b73fb5c8683
                            child_sample_sha1:
                              - efa4a3aa01467cf9a699b418718c150e084f6612
                          analysis:
                            entries:
                              - record_time: '2019-03-26T12:28:05'
                                analysis_type: TC_REPORT
                                analysis_version: 3.0.1
                                tc_report:
                                  info:
                                    file:
                                      file_type: Binary
                                      file_subtype: None
                          xref:
                            entries:
                              - record_time: '2019-03-26T12:38:00'
                                scanners:
                                  - name: ''
                                    result: ''
                                  - name: ''
                                    result: ''
                                info:
                                  scanners:
                                    - name: ''
                                      version: ''
                                      timestamp: '2019-03-03T09:55:00'
                                    - name: ''
                                      version: ''
                                      timestamp: '2019-03-26T07:10:00'
                            first_seen: '2019-03-26T12:27:27'
                            last_seen: '2021-11-10T08:32:37'
                            sample_type: data
                          sources:
                            entries:
                              - record_time: '2021-11-10T08:32:37'
                                tag: reversing_labs
                                properties:
                                  - name: url
                                    value: ''
                              - record_time: '2019-03-26T12:27:27'
                                tag: reversing_labs
                                properties:
                                  - name: file_name
                                    value: 06e6da0dbae4b2fa9d319ff73cd2c40530b1cd7a
                      invalid_hashes:
                        - example_of_a_wrong_hash
                      unknown_hashes:
                        - ca03064987d3c4465f91552ba8b6a883eecfd3e5
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      entries:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - sha1
                            - crc32
                            - md5
                            - sha256
                            - sha384
                            - sha512
                            - ripemd160
                            - sample_size
                          properties:
                            sha1:
                              type: string
                            crc32:
                              type: string
                            md5:
                              type: string
                            sha256:
                              type: string
                            sha384:
                              type: string
                            sha512:
                              type: string
                            ripemd160:
                              type: string
                            sample_size:
                              type: number
                            relationships:
                              type: object
                              properties:
                                container_sample_sha1:
                                  type: array
                                  items:
                                    required: []
                                    properties: {}
                                parent_sample_sha1:
                                  type: array
                                  items:
                                    required: []
                                    properties: {}
                              required:
                                - container_sample_sha1
                                - parent_sample_sha1
                            analysis:
                              type: object
                              properties:
                                entries:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - record_time
                                      - analysis_type
                                      - analysis_version
                                    properties:
                                      record_time:
                                        type: string
                                      analysis_type:
                                        type: string
                                      analysis_version:
                                        type: string
                                      tc_report:
                                        type: object
                                        properties:
                                          info:
                                            type: object
                                            properties:
                                              file:
                                                type: object
                                                properties:
                                                  file_type:
                                                    type: string
                                                  file_subtype:
                                                    type: string
                                                required:
                                                  - file_type
                                                  - file_subtype
                                            required:
                                              - file
                                        required:
                                          - info
                              required:
                                - entries
                            xref:
                              type: object
                              properties:
                                entries:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - record_time
                                    properties:
                                      record_time:
                                        type: string
                                      scanners:
                                        type: array
                                        uniqueItems: true
                                        minItems: 1
                                        items:
                                          required:
                                            - name
                                            - result
                                          properties:
                                            name:
                                              type: string
                                            result:
                                              type: string
                                      info:
                                        type: object
                                        properties:
                                          scanners:
                                            type: array
                                            uniqueItems: true
                                            minItems: 1
                                            items:
                                              required:
                                                - name
                                                - version
                                                - timestamp
                                              properties:
                                                name:
                                                  type: string
                                                version:
                                                  type: string
                                                timestamp:
                                                  type: string
                                        required:
                                          - scanners
                                first_seen:
                                  type: string
                                last_seen:
                                  type: string
                                sample_type:
                                  type: string
                              required:
                                - entries
                                - first_seen
                                - last_seen
                                - sample_type
                            sources:
                              type: object
                              properties:
                                entries:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - record_time
                                      - tag
                                    properties:
                                      record_time:
                                        type: string
                                      tag:
                                        type: string
                                      properties:
                                        type: array
                                        uniqueItems: true
                                        minItems: 1
                                        items:
                                          required:
                                            - name
                                            - value
                                          properties:
                                            name:
                                              type: string
                                            value:
                                              type: string
                              required:
                                - entries
                      invalid_hashes:
                        type: array
                        items:
                          required: []
                          properties: {}
                      unknown_hashes:
                        type: array
                        items:
                          required: []
                          properties: {}
                    required:
                      - entries
                      - invalid_hashes
                      - unknown_hashes
                required:
                  - rl
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/RequestTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/databrowser/rldata/bulk_query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b"
                  ]
                }
              }
            }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/databrowser/rldata/bulk_query/json"

            json = {
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b",
                    "example_of_a_wrong_hash"
                  ]
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        $ref: '#/components/requestBodies/BulkRequest'
  /api/databrowser/rldata/goodware/query/{hash_type}/{hash_value}:
    get:
      summary: 'TCA-0105: File Analysis - Non-Malicious (single query)'
      tags:
        - File Threat Intelligence
      operationId: get-api-databrowser-rldata-goodware-query-hash_type-hash_value
      parameters:
        - $ref: '#/components/parameters/HashType'
        - $ref: '#/components/parameters/HashValue'
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The File Analysis - Non-Malicious [RLDATA Goodware] API provides sample hashes, trust factor, relationships, size, and sources for benign samples only. If a malicious hash is queried, a 404 (Not Found) HTTP response will be returned. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      sample:
                        sha1: a25b6db2d363eaa31de348399aedc5651280b52b
                        trust_factor: 2
                        crc32: '52520008'
                        md5: ca083f61113e1fb8f539ecfa7c725fc8
                        sha256: 10dbb2b27208c5566d326b47950657bf6b3c9a59e302598a128ad7125d5fb4fd
                        sha384: b2bad07d6a3df4b0ec0c8d5f9a4905c289f9348e9e18d41d1b6033576ddf655cf80bc405e059ded6742947d78e0bfeb8
                        sha512: da399c5edc81f9ba50cf49fbf11c8ed1f067f22984fd1284b6fe1d4cc30d5639dc079e08a3b2e029f4060e2c8fb7bdb58a52a595a4a57e3e8c8b9e581c87fe64
                        ripemd160: 2be02239f2c1009ca093e2827591feba5114e117
                        ssdeep: 768:xRMzxdfGYc0qGU+BmFswgfqqYjLvTOwYoVlom0gvzUc4Rys0jxw+:W+x0lERgfFYfrvZUm0g4bydjxw+
                        sample_size: 40870
                        relationships:
                          container_sample_sha1:
                            - 87668585f1f1b07b7247f1cc788a26d9498088d4
                            - 84d552e4a829b7dc36feb638d374571067def34b
                            - 7ce3cc9878c77de183e3fde7872660efdbbfdf39
                            - c46f607eab3c62598a0e0548bb46eab7f5440e3e
                            - 817415fbac13de1597c33ee856af5b62983f1910
                          parent_sample_sha1:
                            - e704be3cb32cf3c4e3cc0232aad20bec2e5caf32
                            - 41b3263c367d526d61d510bb3fe5859e9b003804
                            - 4cca1a6b96d24cc00b876bd418dce38dbd77777d
                            - 25ddf4f9c2ba04ce16be51a44133c10525224a64
                            - d48396c432169340b53bda22eab65ceea758ded7
                        sources:
                          entries:
                            - record_time: '2022-04-13T14:19:01'
                              tag: reversing_labs
                              properties:
                                - name: file_name
                                  value: a25b6db2d363eaa31de348399aedc5651280b52b
                            - record_time: '2021-09-24T04:45:20'
                              tag: reversing_labs
                              properties:
                                - name: url
                                  value: ''
                            - record_time: '2017-05-15T16:34:49'
                              tag: reversing_labs
                              properties:
                                - name: url
                                  value: http://klikhost.com/kp2/player.swf
                                - name: filename
                                  value: player.swf
                              domain:
                                name: klikhost.com
                            - record_time: '2015-09-29T01:13:52'
                              tag: reversing_labs
                            - record_time: '2014-09-08T22:08:48'
                              tag: external_feed
                              properties:
                                - name: tags
                                  value: malware
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      sample:
                        type: object
                        properties:
                          sha1:
                            type: string
                          trust_factor:
                            type: number
                          md5:
                            type: string
                          sha256:
                            type: string
                          sha384:
                            type: string
                          sha512:
                            type: string
                          ripemd160:
                            type: string
                          ssdeep:
                            type: string
                          sample_size:
                            type: number
                          tlsh:
                            type: string
                          relationships:
                            type: object
                            properties:
                              container_sample_sha1:
                                type: array
                                items:
                                  required: []
                                  properties: {}
                            required:
                              - container_sample_sha1
                          sources:
                            type: object
                            properties:
                              entries:
                                type: array
                                uniqueItems: true
                                minItems: 1
                                items:
                                  required:
                                    - record_time
                                    - tag
                                  properties:
                                    record_time:
                                      type: string
                                    tag:
                                      type: string
                                    properties:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required:
                                          - name
                                          - value
                                        properties:
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    domain:
                                      type: object
                                      properties:
                                        name:
                                          type: string
                                      required:
                                        - name
                            required:
                              - entries
                        required:
                          - sha1
                          - trust_factor
                          - md5
                          - sha256
                          - sha384
                          - sha512
                          - ripemd160
                          - ssdeep
                          - sample_size
                          - tlsh
                          - relationships
                          - sources
                    required:
                      - sample
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/databrowser/rldata/goodware/query/sha1/a25b6db2d363eaa31de348399aedc5651280b52b?format=json' --user <username>:<password> --header 'Content-Type: application/json'
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/databrowser/rldata/goodware/query/sha1/a25b6db2d363eaa31de348399aedc5651280b52b?format=json"


            response = requests.get(url, auth=('username', 'password'))

            print(response.text)
  /api/databrowser/rldata/goodware/bulk_query/{post_format}:
    post:
      summary: 'TCA-0105: File Analysis - Non-Malicious (bulk query)'
      tags:
        - File Threat Intelligence
      operationId: post-api-databrowser-rldata-goodware-bulk_query-post_format
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - $ref: '#/components/parameters/ResponseBulk'
      description: The File Analysis - Non-Malicious [RLDATA Goodware] Bulk API provides sample hashes, trust factor, relationships, size, and sources for benign samples only. Up to 100 hashes can be submitted in one request. If a malicious hash is queried, a 404 (Not Found) HTTP response will be returned. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      entries:
                        - sha1: a7afddb68260a60f86c02a021efba7f216c2e7cf
                          trust_factor: 0
                          crc32: '98574167'
                          md5: ecae13117d6f0584c25a9da6c8f8415e
                          sha256: 3316348dbadfb7b11c7c2ea235949419e23f9fa898ad2c198f999617912a9925
                          sha384: ec635fbf3c47a97bf33fc24fe6ee7b04da172537ad8eb01885f29432614c433398789505277ed350ad56648af98c207e
                          sha512: ee021c5aa94c55f1dbbe287200618d386799f21ce4e35af71c9e7474267ebaf5fde5436ea44d689c8abd9dbb24e76da9493f982453cad987d1ca003f9eb9ef34
                          ripemd160: 3f756169279d4a50ee2931f653a1020c39951235
                          sample_size: 4
                          relationships:
                            container_sample_sha1:
                              - 9a6dfa1158a3a5594d828cc54aecb3adf25b0791
                              - fd52de404c18d73f37353bb7d74266e9226a7b4c
                              - 62b295dd94a5f3a53ff6bb902c397103b8519b1e
                              - e2d89992d3ce90e7f15a22a5957fdd135e8e7058
                              - a455b1144988f4e1ddafd2a9a3af49aeefa10515
                            parent_sample_sha1:
                              - 11b6af9a3f58ad692fe958eb11044ebf53b0a79d
                              - 99dba7e826df697e57d4f0a2b623dce07b4fcd51
                              - bf312aa0765083f71f0d12a5eb96589d5fe03887
                              - 9b9872f7f45da560975806a921c0a5578ef439cf
                              - c70b0d518b5e4fe215a8b07eaeed3a49b4fe1a77
                          sources:
                            entries:
                              - record_time: '2024-08-20T01:38:20'
                                tag: reversing_labs
                                properties:
                                  - name: url
                                    value: https://www.scholae.co/web/read/2695/landasan.teknologi.pendidikan.dan.pembelajaran
                                  - name: file_name
                                    value: landasan.teknologi.pendidikan.dan.pembelajaran
                                  - name: request_sequence_urls
                                    value: https://www.scholae.co/web/read/2695/landasan.teknologi.pendidikan.dan.pembelajaran
                                  - name: ip_address
                                    value: 104.21.4.212
                                  - name: request_sequence_ip_addresses
                                    value: 104.21.4.212
                                domain:
                                  name: scholae.co
                              - record_time: '2023-12-02T09:54:15'
                                tag: reversing_labs
                              - record_time: '2016-10-30T05:15:44'
                                tag: microsoft_whitelist
                                properties:
                                  - name: filename
                                    value: word.txt
                                domain:
                                  name: microsoft.com
                              - record_time: '2015-12-03T01:23:22'
                                tag: reversing_labs
                              - record_time: '2014-08-27T00:50:40'
                                tag: reversing_labs
                        - sha1: b363713a938afcd3c74603827fab79e935b2b09b
                          trust_factor: 0
                          crc32: 10dbbec4
                          md5: 3c78b35502b2693fefdfc51cba3a53a5
                          sha256: 36bde66f289a35683683b041c6d8f418a5f36607b547da25d00ad55891e80b88
                          sha384: ce5d21c271776c88490850cad79c5794f7822165e402cf0abde2be1b5ebeb4e988eee6d9ce22ea06babe7ee3233e2c94
                          sha512: 58941c13ad37895a59ef321bbac1c4818734c0ea305cee3eaab38b3d3ee90005843c334eff1a6d1f4bf9f90c0f1d458dac833ed24a9153761935d355fb0dbef6
                          ripemd160: 1f0e050f8570a9e4a99ad38ef05903efac03db37
                          sample_size: 6
                          relationships:
                            container_sample_sha1:
                              - d7ec3017a32364f9670f76e29d813a0065bf2e81
                              - b5a01f94109c408af148b03e81f62242879bf74a
                              - 6fbdcfc3b7f71ab52cd6568981b2b4391a1cae9d
                              - 197b90da2efc37b4558aad0f58314403ee8d25a4
                              - 1975d066d4645bddc3f6c85bda7de29fda3e9199
                            parent_sample_sha1:
                              - 82d8f3cee8a9a3180c9e2a30c42da1527d7a7cc6
                              - 1ea21252dc182f1c5de28b57d7b7ebf498241d6a
                              - e2a3e10524bed3cc6f6e43e7f3fd12b6b89099c9
                              - 21d44ec3d12e1b55afb5113d7d3487fcd2fc59d1
                              - 6748e2ec84ff48af1e67381a31d9a75ba09921d8
                          sources:
                            entries:
                              - record_time: '2020-04-22T07:11:40'
                                tag: reversing_labs
                                properties:
                                  - name: file_name
                                    value: couchdb.override
                                  - name: application_description
                                    value: Extracted from DockerHub, travisci/ci-amethyst:packer-1513010293-3f2fb39
                              - record_time: '2019-09-12T03:12:08'
                                tag: reversing_labs
                                properties:
                                  - name: file_name
                                    value: couchdb.override
                                  - name: application_description
                                    value: Extracted from bugswarm/artifacts:dnanexus-dx-toolkit-104692324
                              - record_time: '2018-05-29T05:53:41'
                                tag: external_feed
                                properties:
                                  - name: tags
                                    value: malware
                      invalid_hashes:
                        - example_of_a_wrong_hash
                      unknown_hashes:
                        - ca03064987d3c4465f91552ba8b6a883eecfd3e5
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      entries:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - sha1
                            - trust_factor
                            - crc32
                            - md5
                            - sha256
                            - sha384
                            - sha512
                            - ripemd160
                            - sample_size
                            - tlsh
                          properties:
                            sha1:
                              type: string
                            trust_factor:
                              type: number
                            crc32:
                              type: string
                            md5:
                              type: string
                            sha256:
                              type: string
                            sha384:
                              type: string
                            sha512:
                              type: string
                            ripemd160:
                              type: string
                            sample_size:
                              type: number
                            tlsh:
                              type: string
                            relationships:
                              type: object
                              properties:
                                container_sample_sha1:
                                  type: array
                                  items:
                                    required: []
                                    properties: {}
                                parent_sample_sha1:
                                  type: array
                                  items:
                                    required: []
                                    properties: {}
                              required:
                                - container_sample_sha1
                                - parent_sample_sha1
                            sources:
                              type: object
                              properties:
                                entries:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - record_time
                                      - tag
                                    properties:
                                      record_time:
                                        type: string
                                      tag:
                                        type: string
                                      properties:
                                        type: array
                                        uniqueItems: true
                                        minItems: 1
                                        items:
                                          required:
                                            - name
                                            - value
                                          properties:
                                            name:
                                              type: string
                                            value:
                                              type: string
                              required:
                                - entries
                      invalid_hashes:
                        type: array
                        items:
                          required: []
                          properties: {}
                      unknown_hashes:
                        type: array
                        items:
                          required: []
                          properties: {}
                    required:
                      - entries
                      - invalid_hashes
                      - unknown_hashes
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/RequestTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/databrowser/rldata/goodware/bulk_query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b"
                  ]
                }
              }
            }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/databrowser/rldata/goodware/bulk_query/json"

            json = {
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "06e6da0dbae4b2fa9d319ff73cd2c40530b1cd7a",
                    "example_of_a_wrong_hash"
                  ]
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        $ref: '#/components/requestBodies/BulkRequest'
  /api/dynamic/analysis/report/v1/query/{hash_type}/{hash_value}:
    get:
      summary: 'TCA-0106: Dynamic Analysis Report (merged report)'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: get-api-dynamic-analysis-report-v1-query-hash_type-hash_value
      parameters:
        - name: hash_type
          in: path
          required: true
          schema:
            type: string
            enum:
              - md5
              - sha1
              - sha256
          description: 'Required parameter. Specifies which hash type will be used in the request. Supported values: **md5**, **sha1**, **sha256**.'
        - $ref: '#/components/parameters/HashValue'
        - $ref: '#/components/parameters/ResponseFormat'
        - name: artifacts_url
          in: query
          schema:
            type: boolean
            enum:
              - true
          description: 'Add `artifacts_url=True` after the path parameters to receive a response containing artifact links (`pcap`, `memory_strings`, `screenshots`, `dropped_files`) for specific reports in the history part of the merged report. '
      description: The File and URL Dynamic Analysis Report service allows users to retrieve dynamic analysis reports for files and URLs executed in the cloud sandbox. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_hash: 734aaf5b557159d58dfc04d9eeecdbaafcfd2372
                      report:
                        platforms:
                          - windows7
                          - windows10
                          - windows11
                        classification: MALICIOUS
                        first_analysis: '2024-12-16T14:15:44'
                        last_analysis: '2024-12-16T17:17:40'
                        history_analysis:
                          - analysis_id: db711a31-a3db-457a-9b83-65325bfb1ac2
                            analysis_time: '2024-12-16T14:15:44'
                            classification: MALICIOUS
                            platform: windows7
                            configuration: MS Office 2007;Java 7;Adobe reader 8;Firefox 37;Google Chrome 51;Internet Explorer 8
                            risk_score: 10
                            classification_version: 3
                            browser: Google Chrome 51
                            sample_name: qdqfms73il
                            geolocation: us
                            locale: en-US
                            analysis_duration: 210
                            warnings:
                              - 'Max analysis timeout: 200s exceeded, the analysis took too long'
                              - 'Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, mscorsvw.exe, spsys.sys, svchost.exe'
                              - Not all processes where analyzed, report is missing behavior information
                              - Report size getting too big, too many NtOpenKeyEx calls found.
                              - Report size getting too big, too many NtQueryValueKey calls found.
                          - analysis_id: ebed9363-3bfc-488a-83f9-529db7564a9f
                            analysis_time: '2024-12-16T14:16:00'
                            classification: MALICIOUS
                            platform: windows10
                            configuration: MS Office 2016;Java 8;Adobe reader 2024;Firefox 63;Google Chrome 104
                            risk_score: 9
                            classification_version: 3
                            browser: Google chrome 104
                            sample_name: cenip0ph2y
                            geolocation: us
                            locale: en-US
                            analysis_duration: 210
                            warnings:
                              - 'Max analysis timeout: 200s exceeded, the analysis took too long'
                              - 'Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, MusNotifyIcon.exe, conhost.exe, svchost.exe'
                              - 'Excluded IPs from analysis (whitelisted): 40.126.29.11, 40.126.29.13, 20.190.157.11, 40.126.29.5, 20.190.157.12, 40.126.29.15, 20.190.157.9, 20.190.157.14, 20.7.251.164, 20.83.72.98'
                              - 'Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, eus2-7.frontdoor.licensing.commerce.microsoft.com, activation-v2.sls.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, www.tm.v4.a.prd.aadg.trafficmanager.net, settings-win.data.microsoft.com, licensing-prod-frontdoor-geomap.trafficmanager.net, login.msa.msidentity.com, licensing.mp.microsoft.com, login.live.com, activation-v2.sls.trafficmanager.net, consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net'
                              - Not all processes where analyzed, report is missing behavior information
                              - Report size getting too big, too many NtOpenKeyEx calls found.
                              - Report size getting too big, too many NtQueryValueKey calls found.
                          - analysis_id: 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                            analysis_time: '2024-12-16T17:17:40'
                            classification: MALICIOUS
                            platform: windows11
                            configuration: MS Office 2016;Java 8;Adobe reader 21;Firefox 96;Google Chrome 113
                            risk_score: 8
                            classification_version: 3
                            browser: Google chrome 113
                            sample_name: yzlxnluza4
                            geolocation: us
                            locale: en-US
                            analysis_duration: 81
                            errors:
                              - 'System.Exception: Operation did not complete successfully because the file contains a virus or potentially unwanted software., copy target files'
                              - No process behavior to analyse as no analysis process or sample was found
                        risk_score: 10
                        classification_version: 3
                        mitre_attack:
                          matrix_list:
                            - name: Enterprise
                              tactics:
                                tactic_list:
                                  - id: TA0005
                                    name: Defense Evasion
                                    techniques:
                                      technique_list:
                                        - id: T1574.002
                                          name: DLL Side-Loading
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1055
                                          name: Process Injection
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1036
                                          name: Masquerading
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1027
                                          name: Obfuscated Files or Information
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                  - id: TA0007
                                    name: Discovery
                                    techniques:
                                      technique_list:
                                        - id: T1497
                                          name: Virtualization/Sandbox Evasion
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1518.001
                                          name: Security Software Discovery
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1010
                                          name: Application Window Discovery
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1018
                                          name: Remote System Discovery
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1083
                                          name: File and Directory Discovery
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1082
                                          name: System Information Discovery
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                  - id: TA0009
                                    name: Collection
                                    techniques:
                                      technique_list:
                                        - id: T1560
                                          name: Archive Collected Data
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1115
                                          name: Clipboard Data
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                        - id: T1056
                                          name: Input Capture
                                          analysis_ids:
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                  - id: TA0011
                                    name: Command and Control
                                    techniques:
                                      technique_list:
                                        - id: T1573
                                          name: Encrypted Channel
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1571
                                          name: Non-Standard Port
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1105
                                          name: Ingress Tool Transfer
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1095
                                          name: Non-Application Layer Protocol
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                                        - id: T1071
                                          name: Application Layer Protocol
                                          analysis_ids:
                                            - db711a31-a3db-457a-9b83-65325bfb1ac2
                                            - ebed9363-3bfc-488a-83f9-529db7564a9f
                        malware_configurations:
                          - configuration: '{"C2 urls": ["green-fuel.us/upload/box/1509uk1.ltc", "188.165.204.210/bin/1509uk1.ltc"]}'
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                            threat_name: Upatre
                            malware_config_ip:
                              - 188.165.204.210
                          - configuration: '{"C2 urls": ["188.165.204.210/bin/1509uk1.ltc", "green-fuel.us/upload/box/1509uk1.ltc"]}'
                            analysis_ids:
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                            threat_name: Upatre
                            malware_config_ip:
                              - 188.165.204.210
                        dropped_files:
                          - md5: e89f75f918dbdcee28604d4e09dd71d7
                            sha1: f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
                            sha256: 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
                            file_name: 1509uk1[1].htm
                            file_path: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A2VOSV08
                            sample_type: Text/HTML
                            sample_size: '114'
                            classification: NO_THREATS_FOUND
                            analysis_ids:
                              - classification: UNKNOWN
                                analysis_id: db711a31-a3db-457a-9b83-65325bfb1ac2
                          - md5: e89f75f918dbdcee28604d4e09dd71d7
                            sha1: f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
                            sha256: 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
                            file_name: 1509uk1[1].htm
                            file_path: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BXA5A9U9
                            sample_type: Text/HTML
                            sample_size: '114'
                            classification: NO_THREATS_FOUND
                            analysis_ids:
                              - classification: UNKNOWN
                                analysis_id: db711a31-a3db-457a-9b83-65325bfb1ac2
                          - md5: 334c5cdf0dea5c43791552ef19e5c43d
                            sha1: 4d35f07441cfd46ced22f399cf6da3af3e140d23
                            sha256: 18bf94b0db0bb9ed73ee54de1e906e7d3d71e58c336063ccf05030e145987cc5
                            file_name: kyyjs.exe
                            file_path: C:\Users\user\AppData\Local\Temp
                            sample_type: MZ/DOS
                            sample_size: '62907'
                            classification: NO_THREATS_FOUND
                            analysis_ids:
                              - classification: UNKNOWN
                                analysis_id: db711a31-a3db-457a-9b83-65325bfb1ac2
                          - md5: e89f75f918dbdcee28604d4e09dd71d7
                            sha1: f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
                            sha256: 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
                            file_name: 1509uk1[1].htm
                            file_path: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1AFL0DSY
                            sample_type: Text/HTML
                            sample_size: '114'
                            classification: NO_THREATS_FOUND
                            analysis_ids:
                              - classification: UNKNOWN
                                analysis_id: ebed9363-3bfc-488a-83f9-529db7564a9f
                        behavioral:
                          - process:
                              name: qdqfms73il.exe
                              parameters: '"C:\Users\user\Desktop\qdqfms73il.exe"'
                              process_id: 2216
                              parent_process_id: 1128
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              process_time: '2024-12-16T06:11:24'
                            mutex_actions:
                              - name: 'NULL'
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name exists
                            file_actions:
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - file_path: C:\Users\user\Desktop
                                file_name: qdqfms73il.exe
                                action_type: file_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - file_path: C:\Windows\Registration
                                file_name: R000000000007.clb
                                action_type: file_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                            registry_actions:
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WOW64
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: DelegateExecute
                            modules_loaded:
                              - module_name: \KnownDlls\wow64win.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls\wow64cpu.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\dwmapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\Riched32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\RICHED20.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\PROPSYS.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*Users*user*AppData*Local*Microsoft*Windows*Caches*cversions.1
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*Users*user*AppData*Local*Microsoft*Windows*Caches*cversions.1.ro
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\ntmarta.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*Users*user*AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\profapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Global\C:*ProgramData*Microsoft*Windows*Caches*cversions.2
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*ProgramData*Microsoft*Windows*Caches*cversions.2
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: 'NULL'
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls\kernel32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\kernel32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls\user32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\DEVOBJ.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                          - process:
                              name: kyyjs.exe
                              parameters: '"C:\Users\user~1\AppData\Local\Temp\kyyjs.exe" '
                              process_id: 1952
                              parent_process_id: 2216
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              process_time: '2024-12-16T06:11:25'
                            mutex_actions:
                              - name: 'NULL'
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\c:!users!user!appdata!roaming!microsoft!windows!cookies!
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\WininetStartupMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\RasPbFile
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\!IETld!Mutex
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\c:!users!user!appdata!roaming!microsoft!windows!ietldcache!
                                action_type: mutex_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                            file_actions:
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - file_path: C:\Users\user~1\AppData\Local\Temp
                                file_name: kyyjs.exe
                                action_type: file_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
                                file_name: index.dat
                                action_type: file_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies
                                file_name: index.dat
                                action_type: file_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A2VOSV08
                                file_name: 1509uk1[1].htm
                                action_type: file_written
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - file_path: C:\Windows
                                file_name: win.ini
                                action_type: file_read
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Temp
                                file_name: kyyjs.exe
                                action_type: file_read
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - file_path: C:\Windows\System32\drivers\etc
                                file_name: hosts
                                action_type: file_read
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                            registry_actions:
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WOW64
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Srp\GP\DLL
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Sorting\Versions
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Diagnostics
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\NLS\Language
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MUI\UILanguages
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\UILanguages\en-US
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\MUI\Settings
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocHandler32
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocHandler32
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocHandler
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocHandler
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\OLE
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Rpc\Extensions
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_CLASSES\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TreatAs
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TreatAs
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\Progid
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\Progid
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\Progid
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\Progid
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\InprocServer32
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\InprocServer32
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\InprocHandler32
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\InprocHandler32
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\InprocHandler
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\InprocHandler
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_CLASSES\AppID\kyyjs.exe
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes\AppID\kyyjs.exe
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\OLE\AppCompat
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Cryptography
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Offload
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_CLASSES\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Linkage
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
                                action_type: key_opened
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\kyyjs_RASAPI32
                                action_type: key_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\kyyjs_RASMANCS
                                action_type: key_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_deleted
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ProxyServer
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
                                action_type: key_value_deleted
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ProxyBypass
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
                                action_type: key_value_deleted
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ProxyBypass
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\kyyjs_RASAPI32
                                action_type: key_value_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: '0'
                                value_name: EnableFileTracing
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\kyyjs_RASMANCS
                                action_type: key_value_created
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: '0'
                                value_name: EnableFileTracing
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
                                action_type: key_value_modified
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: '46 00 00 00 29 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 D0 19 BA 04 84 A6 DA 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 17 00 00 00 00 00 00 00 FE 80 00 00 00 00 00 00 A0 9D B9 F3 CD 50 2B D9 0D 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 FE 80 00 00 00 00 00 00 A0 9D B9 F3 CD 50 2B D9 0D 00 00 00 00 00 00 00 1C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 0A 00 02 0F 00 00 00 00 00 00 00 00 02 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 0C D2 24 01 00 68 48 2A 03 98 D8 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 1B DC 0A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 02 02 02 02 02 02 02 02 00 '
                                value_name: SavedLegacySettings
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
                                action_type: key_value_modified
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: none
                                value_name: WpadLastNetwork
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: DisableUserModeCallbackFilter
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: CWDIllegalInDLLSearch
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: TSAppCompat
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: TransparentEnabled
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: DisableMetaFiles
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: EMPTY
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: InstallLanguageFallback
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\UILanguages\en-US
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: Type
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: PreferredUILanguages
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop\MuiCached
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: buffer overflow
                                value: ''
                                value_name: MachinePreferredUILanguages
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: LoadAppInit_DLLs
                              - key_name: unknown
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: invalid handle
                                value: ''
                                value_name: DisableUserModeCallbackFilter
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: en-US
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: ScrollInset
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: PageAllocatorUseSystemHeap
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: DebugHeapFlags
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: DisableImprovedZoneCheck
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: Security_HKLM_only
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: ComputerName
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\Setup
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                                value: ''
                                value_name: OOBEInProgress
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: PreferExternalManifest
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: FromCacheTimeout
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: object name not found
                                value: ''
                                value_name: SecureProtocols
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoProxyTypes
                                action_type: key_enumerated
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
                                action_type: key_enumerated
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones
                                action_type: key_enumerated
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: pending
                                value: ''
                                value_name: ''
                            process_actions:
                              - path: C:\Users\user\AppData\Local\Temp\kyyjs.exe
                                action_type: process_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                              - path: unknown
                                action_type: process_queried
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                status: success or wait
                            modules_loaded:
                              - module_name: \KnownDlls\wow64win.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls\wow64cpu.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\dwmapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\Riched32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\RICHED20.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\profapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:_Users_user_AppData_Local_Microsoft_Windows_Temporary Internet Files_Content.IE5_index.dat_49152
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:_Users_user_AppData_Roaming_Microsoft_Windows_Cookies_index.dat_16384
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:_Users_user_AppData_Local_Microsoft_Windows_History_History.IE5_index.dat_81920
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\ntmarta.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\dnsapi.DLL
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\iphlpapi.DLL
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\WINNSI.DLL
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\RASAPI32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\rasman.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\rtutils.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\sensapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\SENS Information Cache
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\dhcpcsvc6.DLL
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\dhcpcsvc.DLL
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\rasadhlp.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\CRYPTSP.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\RpcRtRemote.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\VERSION.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:_Users_user_AppData_Roaming_Microsoft_Windows_IETldCache_index.dat_262144
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: 'NULL'
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls\kernel32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\kernel32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls\user32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\KERNELBASE.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\Windows\SharedSection
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\MSVCRT.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\USER32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\GDI32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\LPK.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\USP10.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\ADVAPI32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\RPCRT4.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\SspiCli.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\CRYPTBASE.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\MSCTF.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: unknown
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\ole32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\wininet.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\SHLWAPI.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\urlmon.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\OLEAUT32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\CRYPT32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\MSASN1.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\iertutil.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\shell32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\windows_shell_global_counters
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\WLDAP32.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\ws2_32.DLL
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\NSI.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\Normaliz.dll
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Global\__ComCatalogCache__
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \KnownDlls32\CLBCatQ.DLL
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - module_name: \Sessions\1\BaseNamedObjects\Local\UrlZonesSM_user
                                module_tag: ''
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                          - process:
                              name: cenip0ph2y.exe
                              parameters: '"C:\Users\user\Desktop\cenip0ph2y.exe"'
                              process_id: 3768
                              parent_process_id: 4320
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              process_time: '2024-12-16T15:11:33'
                            mutex_actions:
                              - name: \Sessions\1\BaseNamedObjects\Local\SM0:3768:168:WilStaging_02
                                action_type: mutex_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\SM0:3768:64:WilError_01
                                action_type: mutex_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Global\SyncRootManager
                                action_type: mutex_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name exists
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Desktop
                                file_name: cenip0ph2y.exe
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: \Device\DeviceApi
                                file_name: CMApi
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user~1\AppData\Local
                                file_name: Temp
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64\en-US
                                file_name: PROPSYS.dll.mui
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\Caches
                                file_name: cversions.1.db
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\Caches
                                file_name: '{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db'
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Desktop
                                file_name: desktop.ini
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Documents
                                file_name: desktop.ini
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Music
                                file_name: desktop.ini
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Pictures
                                file_name: desktop.ini
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Videos
                                file_name: desktop.ini
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Downloads
                                file_name: desktop.ini
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\OneDrive
                                file_name: desktop.ini
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                              - file_path: ''
                                file_name: MountPointManager
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user~1\AppData\Local\Temp
                                file_name: kyyjs.exe
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: ''
                                file_name: 'c:'
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: 'C:'
                                file_name: Windows
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user
                                file_name: Desktop
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: apphelp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: ntdll.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: KERNEL32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: KERNELBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: MSVCRT.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: win32u.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: ucrtbase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: msvcp_win.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: gdi32full.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: GDI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: USER32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: uxtheme.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: bcryptPrimitives.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: CRYPTBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: sechost.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: SspiCli.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: RPCRT4.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: combase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: \Device
                                file_name: CNG
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: OLEAUT32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: MSCTF.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: ole32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dwmapi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: Riched32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: RICHED20.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: USP10.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: msls31.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: ADVAPI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows
                                file_name: win.ini
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: kernel.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: clbcatq.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dataexchange.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: d3d11.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dcomp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dxgi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: SHCORE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: twinapi.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: RMCLIENT.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: wininet.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: cfgmgr32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: shlwapi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: profapi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: powrprof.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: FLTLIB.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: windows.storage.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: shell32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: PROPSYS.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: Caches
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: ''
                                file_name: 'C:'
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: ''
                                file_name: STORAGE#Volume#{3ec9d31c-4877-11ef-9f61-806e6f6e6963}#0000000022600000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: edputil.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: urlmon.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: ''
                                file_name: STORAGE#Volume#{3ec9d31c-4877-11ef-9f61-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: iertutil.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: ''
                                file_name: SCSI#CdRom&Ven_VBOX&Prod_CD-ROM#4&2617aeae&0&010000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: Windows.StateRepositoryPS.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: 'C:'
                                file_name: Users
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users
                                file_name: user~1
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user~1
                                file_name: AppData
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user~1\AppData
                                file_name: Local
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: CLDAPI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: WinTypes.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user~1\AppData\Local\Temp
                                file_name: kyyjs.exe
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: Caches
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name collision
                              - file_path: C:\Users\user\AppData\Local\Temp
                                file_name: kyyjs.exe
                                action_type: file_written
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows
                                file_name: win.ini
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Desktop
                                file_name: cenip0ph2y.exe
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Desktop
                                file_name: desktop.ini
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Documents
                                file_name: desktop.ini
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Music
                                file_name: desktop.ini
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Pictures
                                file_name: desktop.ini
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Videos
                                file_name: desktop.ini
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\Downloads
                                file_name: desktop.ini
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                            registry_actions:
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Wow64\x86
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Srp\GP\DLL
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\cenip0ph2y.exe
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\OLE\AppCompat
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Rpc\Extensions
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000160-0000-0000-C000-000000000046}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000160-0000-0000-C000-000000000046}\ProxyStubClsid32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Ole\Extensions
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\TreatAs
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InprocServer32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InprocHandler32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InprocHandler
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\OLE
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\LocalServer32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\LocalServer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\Elevation
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\Dwm
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\cenip0ph2y.exe
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\NonEnum
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Drive\shellex\FolderExtensions
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes\Drive\shellex\FolderExtensions
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\KindMap
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER_Classes\.exe
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes\.exe
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\TreatAs
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InprocServer32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InprocHandler32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InprocHandler
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\LocalServer32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\LocalServer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\Elevation
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\WindowsStore
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\NULL
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: ShellState
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Hidden
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DocObject
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DocObject
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Desktop
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75847177-f077-4171-bd2c-a6bb2164fbd0}\InProcServer32
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_CURRENT_USER_Classes\Directory
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DocObject
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DocObject
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DocObject
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DocObject
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-723508380-312941994-2342154681-1001
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: ProfileImagePath
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e07a3ca1-0000-0000-0000-602200000000}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: Data
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1649d1cf-deaf-4a68-abe8-5c9f68572fd1}\InProcServer32
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e07a3ca1-0000-0000-0000-100000000000}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: Data
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3ec9d32f-4877-11ef-9f61-806e6f6e6963}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: Data
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: FrameTabWindow
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: FrameTabWindow
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: RunBinaryControlHostProcessInSeparateAppContainer
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Security
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: RunBinaryControlHostProcessInSeparateAppContainer
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: TabProcGrowth
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\internet explorer\main
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: TabProcGrowth
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: CreateUriCacheSize
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: CreateUriCacheSize
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: CreateUriCacheSize
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: CreateUriCacheSize
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
                                action_type: key_monitored
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager
                                action_type: key_monitored
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\Settings\LanguageConfiguration
                                action_type: key_value_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop\LanguageConfiguration
                                action_type: key_value_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\UILanguages
                                action_type: key_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions
                                action_type: key_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
                                action_type: key_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones
                                action_type: key_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                            process_actions:
                              - path: C:\Users\user\Desktop\cenip0ph2y.exe
                                action_type: process_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - path: C:\Users\user\AppData\Local\Temp\kyyjs.exe
                                action_type: process_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - path: C:\Users\user\AppData\Local\Temp\kyyjs.exe
                                action_type: process_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - path: C:\Users\user\Desktop\cenip0ph2y.exe
                                action_type: process_terminated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                            modules_loaded:
                              - module_name: \KnownDlls\wow64log.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\apphelp.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\uxtheme.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dwmapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\Riched32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\RICHED20.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\USP10.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\msls31.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dataexchange.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\d3d11.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dcomp.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dxgi.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\twinapi.appcore.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\RMCLIENT.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\HWNDInterface:1044c
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\wininet.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\PROPSYS.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Global\C:*ProgramData*Microsoft*Windows*Caches*cversions.2
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*ProgramData*Microsoft*Windows*Caches*cversions.2
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*Users*user*AppData*Local*Microsoft*Windows*Caches*cversions.1
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*Users*user*AppData*Local*Microsoft*Windows*Caches*cversions.1.ro
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*Users*user*AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\edputil.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\urlmon.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\iertutil.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\Windows.StateRepositoryPS.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\CLDAPI.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\WinTypes.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls\wow64.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls\wow64win.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: unknown
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\kernel32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls\wow64cpu.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\KERNEL32.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\KERNELBASE.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\Windows\SharedSection
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: 'NULL'
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\MSVCRT.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\USER32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\win32u.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\GDI32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\gdi32full.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\msvcp_win.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\ucrtbase.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\IMM32.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\combase.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\RPCRT4.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\SspiCli.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\CRYPTBASE.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\bcryptPrimitives.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\sechost.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\MSCTF.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\OLEAUT32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\Windows\ThemeSection
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Windows\Theme3648067237
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\Windows\Theme1642721904
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\ADVAPI32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\ole32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\kernel.appcore.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Global\__ComCatalogCache__
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\clbcatq.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\SHCORE.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\shell32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\cfgmgr32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\windows.storage.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\shlwapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\profapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\powrprof.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\FLTLIB.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\windows_shell_global_counters
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Global\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Global\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Global\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Global\windows_shell_global_counters
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Local\UrlZonesSM_user
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - process:
                              name: kyyjs.exe
                              parameters: '"C:\Users\user~1\AppData\Local\Temp\kyyjs.exe" '
                              process_id: 1112
                              parent_process_id: 3768
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              process_time: '2024-12-16T15:11:34'
                            mutex_actions:
                              - name: \Sessions\1\BaseNamedObjects\Local\SM0:1112:168:WilStaging_02
                                action_type: mutex_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
                                action_type: mutex_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name exists
                              - name: \Sessions\1\BaseNamedObjects\Local\SM0:1112:64:WilError_01
                                action_type: mutex_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user~1\AppData\Local\Temp
                                file_name: kyyjs.exe
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: \Device\DeviceApi
                                file_name: CMApi
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: \Device\Afd
                                file_name: Endpoint
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: ''
                                file_name: Nsi
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64\en-US
                                file_name: mswsock.dll.mui
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: wshqos.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64\en-US
                                file_name: wshqos.dll.mui
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: \Device
                                file_name: RasAcd
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{7A9DD774-F871-4885-A061-6795D88B5FF8}
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{3EC9D319-4877-11EF-9F61-806E6F6E6963}
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                              - file_path: C:\Windows\system32\drivers\etc
                                file_name: hosts
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: 'C:'
                                file_name: Windows
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user~1\AppData\Local
                                file_name: Temp
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: apphelp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: ntdll.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: KERNEL32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: KERNELBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: ''
                                file_name: 'C:'
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: 'C:'
                                file_name: Users
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users
                                file_name: user~1
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user~1
                                file_name: AppData
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user~1\AppData
                                file_name: Local
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: MSVCRT.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: win32u.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: ucrtbase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: msvcp_win.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: gdi32full.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: GDI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: USER32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: uxtheme.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: bcryptPrimitives.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: CRYPTBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: sechost.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: SspiCli.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: RPCRT4.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: combase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: \Device
                                file_name: CNG
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: OLEAUT32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: MSCTF.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: ole32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dwmapi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: Riched32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: RICHED20.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: USP10.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: msls31.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: ADVAPI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows
                                file_name: win.ini
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: kernel.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: clbcatq.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dataexchange.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: d3d11.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dcomp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dxgi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: SHCORE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: twinapi.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: RMCLIENT.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: wininet.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: cfgmgr32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: shlwapi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: profapi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: powrprof.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: FLTLIB.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: windows.storage.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: shell32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Temp
                                file_name: 1f9a3eb5f0d09d97979b90b8f17f1939e7cb6.exe
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                              - file_path: C:\Windows\SysWOW64
                                file_name: iertutil.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: WS2_32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: ondemandconnroutehelper.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: IPHLPAPI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: winhttp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: mswsock.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: WINNSI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: NSI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: urlmon.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: DNSAPI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: rasadhlp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dhcpcsvc6.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: dhcpcsvc.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: fwpuclnt.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\SysWOW64
                                file_name: bcrypt.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: \Device
                                file_name: KsecDD
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE
                                file_name: 1AFL0DSY
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE
                                file_name: CCSD3KIS
                                action_type: file_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users
                                file_name: user
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name collision
                              - file_path: C:\Users\user\AppData
                                file_name: Local
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name collision
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: INetCache
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name collision
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: INetCookies
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name collision
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: History
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name collision
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE
                                file_name: 1AFL0DSY
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1AFL0DSY
                                file_name: 1509uk1[1].htm
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE
                                file_name: CCSD3KIS
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CCSD3KIS
                                file_name: 1509uk1[1].htm
                                action_type: file_created
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1AFL0DSY
                                file_name: 1509uk1[1].htm
                                action_type: file_written
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CCSD3KIS
                                file_name: 1509uk1[1].htm
                                action_type: file_written
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows
                                file_name: win.ini
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Temp
                                file_name: kyyjs.exe
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                              - file_path: C:\Windows\System32\drivers\etc
                                file_name: hosts
                                action_type: file_read
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                            registry_actions:
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Wow64\x86
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Srp\GP\DLL
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Disable8And16BitMitigation
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\NLS\Language
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MUI\UILanguages
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\UILanguages\en-US
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\MUI\Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop\MuiCached\MachineLanguageConfiguration
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Control Panel\Desktop
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop\LanguageConfiguration
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop\MuiCached
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Sorting\Versions
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kyyjs.exe
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\Display
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\OLE
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\NULL
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Ole\FeatureDevelopmentProperties
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppModel\Lookaside\Packages
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\OLE\Tracing
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\OLEAUT
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Sorting\Ids
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Rpc
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\ActiveComputerName
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\Setup
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows NT\Rpc
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Classes
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\kyyjs.exe
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\OLE\AppCompat
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Rpc\Extensions
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000160-0000-0000-C000-000000000046}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000160-0000-0000-C000-000000000046}\ProxyStubClsid32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Ole\Extensions
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\TreatAs
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InprocServer32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InprocHandler32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InprocHandler
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\OLE
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\LocalServer32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\LocalServer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\Elevation
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\Dwm
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Hvsi
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PropertyBag
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: \REGISTRY\USER
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_USERS.DEFAULT
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ProfileList
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PropertyBag
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000323-0000-0000-C000-000000000046}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A168AADC-1674-49DA-AD4F-4F27DF8760D0}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{a168aadc-1674-49da-ad4f-4f27df8760d0}\ProxyStubClsid32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\TreatAs
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InprocServer32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InprocHandler32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InprocHandler
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\LocalServer32
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\LocalServer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\Elevation
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Internet Explorer\Main\FeatureControl
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\RETRY_HEADERONLYPOST_ONCONNECTIONRESET
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\RETRY_HEADERONLYPOST_ONCONNECTIONRESET
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INCLUDE_PORT_IN_SPN_KB908209
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INCLUDE_PORT_IN_SPN_KB908209
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DIGEST_NO_EXTRAS_IN_URI
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DIGEST_NO_EXTRAS_IN_URI
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Internet Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Internet Explorer\Main
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCH_SEND_AUX_RECORD_KB_2618444
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCH_SEND_AUX_RECORD_KB_2618444
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\dnscache
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_TOKEN_BINDING
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_TOKEN_BINDING
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\AppId_Catalog
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\AppId_Catalog\12528D89
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\00000007
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\00000014
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Security
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PeerDist\Service
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\PeerDist\Service
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Parameters
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\afunix\Parameters\Winsock
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Setup Migration\Providers\Tcpip6
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SQMServiceList
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc\Parameters
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\windows\CurrentVersion\Internet Settings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\ZoneMap\Ranges\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\ZoneMap\Ranges\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Security
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Security
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URI_DISABLECACHE
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URI_DISABLECACHE
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PropertyBag
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-723508380-312941994-2342154681-1001
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\KnownFolderSettings
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PropertyBag
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Setup Migration\Providers\Tcpip
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\WindowsStore
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-US
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows NT\DnsClient
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Policies\Microsoft\System\DNSClient
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DnsCache\Parameters\DnsPolicyConfig
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\{7A9DD774-F871-4885-A061-6795D88B5FF8}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\{3EC9D319-4877-11EF-9F61-806E6F6E6963}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{3ec9d319-4877-11ef-9f61-806e6f6e6963}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7A9DD774-F871-4885-A061-6795D88B5FF8}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3EC9D319-4877-11EF-9F61-806E6F6E6963}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7A9DD774-F871-4885-A061-6795D88B5FF8}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\InterfaceSpecificParameters\{7A9DD774-F871-4885-A061-6795D88B5FF8}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3EC9D319-4877-11EF-9F61-806E6F6E6963}
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
                                action_type: key_opened
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ResourcePolicies
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wow64\x86
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: kyyjs.exe
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: TSAppCompat
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: TransparentEnabled
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\FileSystem
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: LongPathsEnabled
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: LogFlags
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Cache
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: EMPTY
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: InstallLanguageFallback
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\UILanguages\en-US
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Type
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: PreferredUILanguages
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop\MuiCached
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: MachinePreferredUILanguages
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DisableMetaFiles
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Enabled
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: FipsAlgorithmPolicy
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: PageAllocatorUseSystemHeap
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: en-US
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: en-US
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: ScrollInset
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: MaxRpcSize
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ComputerName
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\Setup
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: OOBEInProgress
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: AllowDevelopmentWithoutDevLicense
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: AllowDevelopmentWithoutDevLicense
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: RaiseDefaultAuthnLevel
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: NdrOleExtDLL
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000160-0000-0000-C000-000000000046}\ProxyStubClsid32
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\Extensions
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: DragDropExtension
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Com+Enabled
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: InprocServer32
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Dwm
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DebugFailFast
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: SyncMode5
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: SessionStartTimeDefaultDeltaSecs
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Cache
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: Default
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Cache
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{a168aadc-1674-49da-ad4f-4f27df8760d0}\ProxyStubClsid32
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: 'NULL'
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: InprocServer32
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: MBCSAPIforCrack
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: Security_HKLM_only
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: kyyjs.exe
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: FEATURE_CLIENTAUTHCERTFILTER
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: FEATURE_CLIENTAUTHCERTFILTER
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: kyyjs.exe
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: kyyjs.exe
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: Security_HKLM_Only
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: EnableHttp1_1
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\download
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: FeatureEnableTokenBindingOverride
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: WinSock_Registry_Version
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Serial_Access_Num
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: PackedCatalogItem
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Serial_Access_Num
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: LibraryPath
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: LibraryPath
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: LibraryPath
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: LibraryPath
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: LibraryPath
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: LibraryPath
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: FrameTabWindow
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: FrameTabWindow
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: RunBinaryControlHostProcessInSeparateAppContainer
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Security
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: RunBinaryControlHostProcessInSeparateAppContainer
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\internet explorer\main
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: TabProcGrowth
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: Enable
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DefaultSecureProtocols
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Parameters
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: Transports
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\afunix\Parameters\Winsock
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: Mapping
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: Mapping
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Winsock
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: Mapping
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Setup Migration\Providers\Tcpip6
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: WinSock 2.0 Provider ID
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SQMServiceList
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: SQMServiceList
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinHttpAutoProxySvc\Parameters
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: ProxyDllFile
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Flags
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Flags
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Flags
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Flags
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Flags
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\feature_localmachine_lockdown
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: kyyjs.exe
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: kyyjs.exe
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: AutoDetect
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: 1A10
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: object name not found
                                value: ''
                                value_name: DisableKnownFolders
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-723508380-312941994-2342154681-1001
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: buffer overflow
                                value: ''
                                value_name: ProfileImagePath
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}
                                action_type: key_value_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                                value: ''
                                value_name: Category
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
                                action_type: key_monitored
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
                                action_type: key_monitored
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
                                action_type: key_monitored
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\Settings\LanguageConfiguration
                                action_type: key_value_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Control Panel\Desktop\LanguageConfiguration
                                action_type: key_value_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
                                action_type: key_value_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\UILanguages
                                action_type: key_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
                                action_type: key_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones
                                action_type: key_enumerated
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: pending
                                value: ''
                                value_name: ''
                            process_actions:
                              - path: C:\Users\user\AppData\Local\Temp\kyyjs.exe
                                action_type: process_queried
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                                status: success or wait
                            modules_loaded:
                              - module_name: \KnownDlls\wow64log.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\apphelp.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\uxtheme.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dwmapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\Riched32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\RICHED20.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\USP10.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\msls31.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dataexchange.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\d3d11.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dcomp.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dxgi.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\twinapi.appcore.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\RMCLIENT.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\HWNDInterface:2044c
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\wininet.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\iertutil.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\ondemandconnroutehelper.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\IPHLPAPI.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\winhttp.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\mswsock.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\WINNSI.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\urlmon.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\DNSAPI.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\rasadhlp.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dhcpcsvc6.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\dhcpcsvc.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\fwpuclnt.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\bcrypt.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls\wow64.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls\wow64win.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: unknown
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\kernel32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls\wow64cpu.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\KERNEL32.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\KERNELBASE.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\Windows\SharedSection
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: 'NULL'
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\MSVCRT.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\USER32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\win32u.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\GDI32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\gdi32full.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\msvcp_win.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\ucrtbase.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\IMM32.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\combase.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\RPCRT4.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\SspiCli.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\CRYPTBASE.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\bcryptPrimitives.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\sechost.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\MSCTF.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\OLEAUT32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\Windows\ThemeSection
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Windows\Theme3648067237
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\Windows\Theme1642721904
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\ADVAPI32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\ole32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\kernel.appcore.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Global\__ComCatalogCache__
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\clbcatq.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\SHCORE.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\shell32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\cfgmgr32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\windows.storage.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\shlwapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\profapi.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\powrprof.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\FLTLIB.DLL
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\windows_shell_global_counters
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\WS2_32.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Global\F932B6C7-3A20-46A0-B8A0-8894AA421973
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \KnownDlls32\NSI.dll
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - module_name: \Sessions\1\BaseNamedObjects\Local\UrlZonesSM_user
                                module_tag: ''
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                        network:
                          http:
                            - url: http://green-fuel.us/upload/box/1509uk1.ltc
                              method: GET
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              process_id: 1952
                            - url: http://fsd-studio.it/bin/1509uk1.ltc
                              method: GET
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              process_id: 1952
                            - url: http://fsd-studio.it/bin/1509uk1.ltc
                              method: GET
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              process_id: 1112
                            - url: http://green-fuel.us/upload/box/1509uk1.ltc
                              method: GET
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              process_id: 1112
                          dns:
                            - type: A (IP address)
                              value: fsd-studio.it
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              address: 195.231.57.206
                              process_id: 1952
                            - type: A (IP address)
                              value: green-fuel.us
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              address: 15.197.148.33
                              process_id: 1952
                            - type: A (IP address)
                              value: green-fuel.us
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              address: 3.33.130.190
                              process_id: 1952
                            - type: A (IP address)
                              value: wpad.example.org
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              address: none
                              process_id: 1952
                            - type: A (IP address)
                              value: fsd-studio.it
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              address: 195.231.57.206
                              process_id: 1112
                            - type: A (IP address)
                              value: green-fuel.us
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              address: 3.33.130.190
                              process_id: 1112
                            - type: A (IP address)
                              value: green-fuel.us
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              address: 15.197.148.33
                              process_id: 1112
                          tcp:
                            - destination_port: 80
                              destination_ip: 195.231.57.206
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              process_id: 1952
                            - destination_port: 18903
                              destination_ip: 188.165.204.210
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              process_id: 1952
                            - destination_port: 80
                              destination_ip: 3.33.130.190
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              process_id: 1952
                            - destination_port: 80
                              destination_ip: 195.231.57.206
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              process_id: 1112
                            - destination_port: 80
                              destination_ip: 3.33.130.190
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              process_id: 1112
                            - destination_port: 18903
                              destination_ip: 188.165.204.210
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              process_id: 1112
                          udp:
                            - destination_port: 53
                              destination_ip: 8.8.8.8
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              process_id: 1952
                            - destination_port: 53
                              destination_ip: 8.8.4.4
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              process_id: 1952
                            - destination_port: 53
                              destination_ip: 8.8.8.8
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              process_id: 1112
                          url:
                            - url: http://fsd-studio.it/bin/1509uk1.ltc
                              source: network
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://188.165.204.210:18903/1509uk1/088753/1/0/0/
                              source: memory
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              classification: suspicious
                              categories:
                                - malware_file
                            - url: http://fsd-studio.it/bin/1509uk1.ltcV
                              source: memory
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              classification: suspicious
                            - url: http://188.165.204.210:18903/1509uk1/088753/1/0/0/a
                              source: memory
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              classification: malicious
                              categories:
                                - phishing
                                - uncategorized
                            - url: http://green-fuel.us/upload/box/1509uk1.ltc#
                              source: memory
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              classification: malicious
                              categories:
                                - malware_file
                            - url: http://188.165.204.210:18903/1509uk1/088753/0/61-SP1/0/
                              source: memory
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              classification: malicious
                              categories:
                                - phishing
                                - uncategorized
                            - url: http://green-fuel.us/upload/box/1509uk1.ltc
                              source: network
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - malware_file
                            - url: http://fsd-studio.it/bin/1509uk1.ltcn
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltc)
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltch
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltcicrosoft
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - business_and_economy
                                - phishing
                            - url: http://fsd-studio.it/bin/1509uk1.ltcoe
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltc&
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://green-fuel.us/upload/box/1509uk1.ltcn
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                              categories:
                                - phishing
                            - url: http://green-fuel.us/upload/box/1509uk1.ltccV
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltc(x86)
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - business_and_economy
                                - phishing
                            - url: http://fsd-studio.it/bin/1509uk1.ltcb
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltca
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://188.165.204.210:18903/1509uk1/287400/0/62/0/
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                            - url: http://188.165.204.210:18903/1509uk1/287400/1/0/0/?
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: unknown
                            - url: http://fsd-studio.it/bin/1509uk1.ltcg$
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                            - url: http://green-fuel.us/upload/box/1509uk1.ltc5
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                              categories:
                                - phishing
                            - url: http://green-fuel.us/upload/box/1509uk1.ltcu
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                              categories:
                                - phishing
                            - url: http://green-fuel.us/upload/box/1509uk1.ltcin/1509uk1.ltc
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                              categories:
                                - phishing
                            - url: http://fsd-studio.it/bin/1509uk1.ltcrs
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - business_and_economy
                                - phishing
                            - url: http://188.165.204.210:18903/1509uk1/287400/1/0/0/Y
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - uncategorized
                                - phishing
                            - url: http://green-fuel.us/upload/box/1509uk1.ltc-
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                              categories:
                                - phishing
                            - url: http://188.165.204.210:18903/1509uk1/287400/1/0/0/
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: unknown
                            - url: 'http://fsd-studio.it/bin/1509uk1.ltcWbem;C:'
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - business_and_economy
                                - phishing
                            - url: http://green-fuel.us/upload/box/1509uk1.ltcc
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                              categories:
                                - phishing
                            - url: http://fsd-studio.it/bin/1509uk1.ltcp
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltc15361d5e7276f759aicLMEM
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - business_and_economy
                                - phishing
                            - url: http://fsd-studio.it/
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltcion
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://green-fuel.us/upload/box/1509uk1.ltcpload/box/1509uk1.ltc
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                              categories:
                                - phishing
                            - url: http://green-fuel.us/upload/box/1509uk1.ltcQ
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltcI&
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: 'http://fsd-studio.it/bin/1509uk1.ltcjavapath;C:'
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - business_and_economy
                                - phishing
                            - url: http://fsd-studio.it/bin/1509uk1.ltc81b6e3920277c6418icLMEM
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - business_and_economy
                                - phishing
                            - url: http://fsd-studio.it/bin/1509uk1.ltcW
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://188.165.204.210:18903/1509uk1/287400/1/0/0/u
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - uncategorized
                                - phishing
                            - url: http://fsd-studio.it/bin/1509uk1.ltcWindowsApps;PATHEX
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - business_and_economy
                                - phishing
                            - url: http://fsd-studio.it/bin/1509uk1.ltcem32
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                              categories:
                                - business_and_economy
                                - phishing
                            - url: http://fsd-studio.it/bin/1509uk1.ltcR
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://green-fuel.us/upload/box/1509uk1.ltcck
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltc6&
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: malicious
                            - url: http://fsd-studio.it/bin/1509uk1.ltcO
                              source: memory
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              classification: suspicious
                        sigma_detections:
                          - description: 'Sigma detected: Use Short Name Path in Command Line'
                            sources:
                              - details: 'Data: Command: "C:\Users\user~1\AppData\Local\Temp\kyyjs.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\kyyjs.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\kyyjs.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\kyyjs.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\kyyjs.exe, ParentCommandLine: "C:\Users\user\Desktop\qdqfms73il.exe", ParentImage: C:\Users\user\Desktop\qdqfms73il.exe, ParentProcessId: 2216, ParentProcessName: qdqfms73il.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\kyyjs.exe" , ProcessId: 1952, ProcessName: kyyjs.exe'
                                source: Process started
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - details: 'Data: Command: "C:\Users\user~1\AppData\Local\Temp\kyyjs.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\kyyjs.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\kyyjs.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\kyyjs.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\kyyjs.exe, ParentCommandLine: "C:\Users\user\Desktop\cenip0ph2y.exe", ParentImage: C:\Users\user\Desktop\cenip0ph2y.exe, ParentProcessId: 3768, ParentProcessName: cenip0ph2y.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\kyyjs.exe" , ProcessId: 1112, ProcessName: kyyjs.exe'
                                source: Process started
                                analysis_ids:
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - description: 'Sigma detected: Modification of IE Registry Settings'
                            sources:
                              - details: 'Data: Details: 46 00 00 00 29 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 D0 19 BA 04 84 A6 DA 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 17 00 00 00 00 00 00 00 FE 80 00 00 00 00 00 00 A0 9D B9 F3 CD 50 2B D9 0D 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 FE 80 00 00 00 00 00 00 A0 9D B9 F3 CD 50 2B D9 0D 00 00 00 00 00 00 00 1C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 0A 00 02 0F 00 00 00 00 00 00 00 00 02 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 0C D2 24 01 00 68 48 2A 03 98 D8 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 1B DC 0A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 02 02 02 02 02 02 02 02 00 , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\kyyjs.exe, ProcessId: 1952, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings'
                                source: Registry Key set
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                        signatures:
                          - sig_id: 1532
                            description: Sample is known by Antivirus
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                          - sig_id: 1571
                            description: Sample reads its own file content
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 621
                            description: Uses 32bit PE files
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                          - sig_id: 501
                            description: Found malware configuration
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1460
                            description: Reads software policies
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1022354945
                            description: 'Sigma detected: Use Short Name Path in Command Line'
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 394
                            description: Sample file is different than the original file name gathered from version info
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                          - sig_id: 1271
                            description: Spawns processes
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 434
                            description: Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 472
                            description: Performs connections to IPs without corresponding DNS lookups
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1233
                            description: Tries to load missing DLLs
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1458
                            description: Uses an in-process (OLE) Automation server
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1167
                            description: Drops PE files
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 100346
                            description: Yara detected Upatre
                            risk_factor: 10
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1335
                            description: May sleep (evasive loops) to hinder dynamic analysis
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1577
                            description: Uses code obfuscation techniques (call, push, ret)
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 362
                            description: Multi AV Scanner detection for the submitted file
                            risk_factor: 10
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                          - sig_id: 379
                            description: Detected TCP or UDP traffic on non-standard ports
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 374
                            description: Icon mismatch, binary includes an Icon from a different legit application in order to fool users
                            risk_factor: 10
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                          - sig_id: 350
                            description: Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 514
                            description: PE file contains sections with non-standard names
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                          - sig_id: 489
                            description: Connects to many ports on the same IP (likely port scanning)
                            risk_factor: 8
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 357
                            description: URLs found in memory or binary data
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1826
                            description: Detected crypto function
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1628
                            description: Creates a window with clipboard capturing capabilities
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                          - sig_id: 506
                            description: C2 URLs / IPs found in malware configuration
                            risk_factor: 8
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1275
                            description: Downloads files
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                          - sig_id: 1276
                            description: Creates temporary files
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 353
                            description: Performs DNS lookups
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1101
                            description: Contains functionality to call native functions
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1454
                            description: Uses Rich Edit Controls
                            risk_factor: 0
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 420
                            description: Classification label
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                          - sig_id: 1397
                            description: Disables application error messages (SetErrorMode)
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1550
                            description: Sample tries to load a library which is not present or installed on the analysis machine
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1710
                            description: Contains functionality to check if a window is minimized (may be used to check if an application is visible)
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1464
                            description: Executable creates window controls seldom found in malware
                            risk_factor: 0
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1257
                            description: Reads INI files
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 349
                            description: Downloads files from web servers via HTTP
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 358
                            description: May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1353
                            description: Reads the hosts file
                            risk_factor: 5
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1534
                            description: Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                          - sig_id: 1790
                            description: Creates a process in suspended mode (likely to inject code)
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1250
                            description: Entrypoint lies outside standard sections
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                          - sig_id: 20001
                            description: Suspicious URL detected via ReversingLabs Network Threat Intelligence
                            risk_factor: 7
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 20002
                            description: Malicious URL detected via ReversingLabs Network Threat Intelligence
                            risk_factor: 9
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1339
                            description: Creates a DirectInput object (often for capturing keystrokes)
                            risk_factor: 7
                            analysis_ids:
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - sig_id: 1145
                            description: Creates files inside the user directory
                            risk_factor: 5
                            analysis_ids:
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                        threat_names:
                          - threat_name: Upatre
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                          - threat_name: Unknown
                            analysis_ids:
                              - 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                        yara:
                          entries:
                            - source_type: memory_dump
                              source_name: C:\Users\user\AppData\Local\Temp\kyyjs.exe
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              rule:
                                - description: Yara detected Upatre
                                  analysis_ids:
                                    - db711a31-a3db-457a-9b83-65325bfb1ac2
                                    - ebed9363-3bfc-488a-83f9-529db7564a9f
                            - source_type: memory_dump
                              source_name: C:\Users\user\Desktop\qdqfms73il.exe
                              analysis_ids:
                                - db711a31-a3db-457a-9b83-65325bfb1ac2
                              rule:
                                - description: Yara detected Upatre
                                  analysis_ids:
                                    - db711a31-a3db-457a-9b83-65325bfb1ac2
                            - source_type: memory_dump
                              source_name: C:\Users\user\Desktop\cenip0ph2y.exe
                              analysis_ids:
                                - ebed9363-3bfc-488a-83f9-529db7564a9f
                              rule:
                                - description: Yara detected Upatre
                                  analysis_ids:
                                    - ebed9363-3bfc-488a-83f9-529db7564a9f
                        md5: 2b7e5d3d7fd53274a61636bd7f5c35d9
                        sha256: e0c641e1d3b7c54d9cfa7ee5698fcfd61b230b0d59dd5672a969d651499e74c4
                        bot_configurations:
                          - botFamily: Upater
                            botServers:
                              - botServer: green-fuel.us/upload/box/1509uk1.ltc
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                              - botServer: 188.165.204.210/bin/1509uk1.ltc
                                analysis_ids:
                                  - db711a31-a3db-457a-9b83-65325bfb1ac2
                                  - ebed9363-3bfc-488a-83f9-529db7564a9f
                            analysis_ids:
                              - db711a31-a3db-457a-9b83-65325bfb1ac2
                              - ebed9363-3bfc-488a-83f9-529db7564a9f
                        sha1: 734aaf5b557159d58dfc04d9eeecdbaafcfd2372
                      private_data_filtered: false
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - report
                      - requested_hash
                      - private_data_filtered
                    properties:
                      report:
                        type: object
                        properties:
                          md5:
                            type: string
                            format: md5
                          sha1:
                            type: string
                            format: sha1
                          sha256:
                            type: string
                            format: sha256
                          url:
                            type: string
                            format: url
                          url_base64:
                            type: string
                            format: base64
                          risk_score:
                            type: number
                            minimum: 0
                            maximum: 10
                            description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                          classification:
                            type: string
                            description: The classification of the sample.
                            enum:
                              - MALICIOUS
                              - SUSPICIOUS
                              - KNOWN
                              - UNKNOWN
                          interactive:
                            type: string
                            description: |
                              Whether this report is the result of an interactive session
                              from Spectra Analyze.
                            enum:
                              - 'true'
                              - 'false'
                          timeout:
                            type: number
                            description: The maximum configured time the sample was allowed to run on the VM.
                          classification_version:
                            type: number
                          first_analysis:
                            type: string
                            format: date-time
                          last_analysis:
                            type: string
                            format: date-time
                          history_analysis:
                            type: array
                            description: An object containing an overview of all available reports.
                            items:
                              type: object
                              properties:
                                analysis_id:
                                  type: string
                                  description: The analysis ID of the report.
                                analysis_time:
                                  type: string
                                  description: The date and time of the analysis.
                                  format: date-time
                                classification:
                                  type: string
                                  description: The classification of the sample.
                                  enum:
                                    - MALICIOUS
                                    - SUSPICIOUS
                                    - KNOWN
                                    - UNKNOWN
                                platform:
                                  type: string
                                  description: The platform used to analyze the sample.
                                configuration:
                                  type: string
                                  description: A short description of the platform configuration specifics (for example, "Win10 x64, Office 2016, Java 8 Update 191").
                                optional_parameters:
                                  type: string
                                  enum:
                                    - internet_simulation=true
                                    - internet_simulation=false
                                  example: internet_simulation=false
                                  description: |
                                    An object containing a list of optional parameters used during analysis.
                                    If `internet_simulation` is true, dynamic analysis was performed without connecting to the internet and a simulated network was used instead. If this value is false, the report is the same as if the parameter is omitted from the response. HTTPS traffic information is not monitored during analysis when `internet_simulation` is set to true.
                                risk_score:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                                  description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                                classification_version:
                                  type: number
                                browser:
                                  type: string
                                  description: Browser used in the sandbox.
                                sample_name:
                                  type: string
                                  description: Custom file name and/or extension provided on submission. Custom extensions impact which application was used to open and run the file.
                                geolocation:
                                  type: string
                                  description: Geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods.
                                  default: us
                                  enum:
                                    - us
                                    - uk
                                    - in
                                    - br
                                    - de
                                    - jp
                                    - sg
                                    - it
                                    - es
                                    - fr
                                    - tor
                                locale:
                                  type: string
                                  description: The configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes.
                                  default: en-US
                                  enum:
                                    - en-US
                                    - en-GB
                                    - pt-BR
                                    - de-DE
                                    - ja-JP
                                    - it-IT
                                    - es-ES
                                    - fr-FR
                                analysis_duration:
                                  type: number
                                  description: The duration of the analysis (in seconds).
                                warnings:
                                  type: array
                                  items:
                                    type: string
                                errors:
                                  type: array
                                  items:
                                    type: string
                                pcap:
                                  type: string
                                  format: url
                                  description: Contains a link to download the PCAP file with all the network traffic generated during sample execution. PCAP files have a retention period of 14 days. This link is generated when the report is requested, and expires in 1 hour.
                                memory_strings:
                                  type: string
                                  format: url
                                  description: Contains a link to download a dump of memory strings stored in the memory and captured during file execution. Memory strings have a retention period of 14 days. This link is generated when the report is requested, and expires in 1 hour.
                                screenshots:
                                  type: string
                                  format: url
                                  description: Contains a link to screenshots collected during the analysis. Screenshots have a retention period of 14 days. This link is generated when the report is requested, and expires in 1 hour.
                                dropped_files:
                                  type: string
                                  format: url
                                  description: Contains a link to files dropped during the analysis. Screenshots have a retention period of 14 days. This link is generated when the report is requested, and expires in 1 hour.
                          platforms:
                            type: array
                            description: Platforms used to analyze the sample.
                            items:
                              type: string
                              enum:
                                - windows7
                                - windows10
                                - macos11
                          behavioral:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            description: Behavioral information about the executed sample. Every object relates one process spawned during sample execution to specific actions it performed.
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                                    example: 0248db42-ff73-4ca2-ac89-2f98dbbfbcb9
                                process_actions:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  description: All actions performed by spawned processes. Entries contain the process name, the type of action that was performed, and if the action was successful or not.
                                  items:
                                    type: object
                                    properties:
                                      analysis_ids:
                                        type: array
                                        items:
                                          type: string
                                          format: uuid
                                      status:
                                        type: string
                                        minLength: 1
                                      path:
                                        type: string
                                        minLength: 1
                                      action_type:
                                        type: string
                                        minLength: 1
                                    required:
                                      - analysis_ids
                                      - status
                                      - path
                                      - action_type
                                process:
                                  type: object
                                  description: Information about the process that spawned during dynamic analysis. Contains the process ID, process name, the full execution path with parameters, and the parent process ID.
                                  properties:
                                    analysis_ids:
                                      type: array
                                      items:
                                        type: string
                                        format: uuid
                                    name:
                                      type: string
                                      minLength: 1
                                    parameters:
                                      type: string
                                      minLength: 1
                                    process_id:
                                      type: number
                                    parent_process_id:
                                      type: number
                                  required:
                                    - analysis_ids
                                    - name
                                    - parameters
                          signatures:
                            description: Abstracted behaviors, attributes, and content identified during analysis. Each signature has a signature ID, description and a risk score.
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                                sig_id:
                                  type: string
                                  description: Signature ID
                                description:
                                  type: string
                                  description: Signature description in human readable form
                                risk_factor:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                                  description: '[Risk factor](/General/AnalysisAndClassification/Classification#risk-score) assigned to this signature.'
                              required:
                                - analysis_ids
                          threat_names:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                                threat_name:
                                  type: string
                                  description: Detected threat in the sample.
                              required:
                                - analysis_ids
                          yara:
                            type: object
                            properties:
                              entries:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    analysis_ids:
                                      type: array
                                      items:
                                        type: string
                                        format: uuid
                                    source_type:
                                      type: string
                                      enum:
                                        - sample
                                        - dropped_file
                                        - memory_dump
                                    source_name:
                                      type: string
                                      description: Path to the matched file.
                                    rule:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          analysis_ids:
                                            type: array
                                            items:
                                              type: string
                                              format: uuid
                                          description:
                                            type: string
                                            description: Descriptive YARA detections.
                                          matched_data:
                                            type: array
                                            items:
                                              type: object
                                              properties:
                                                matched_string:
                                                  type: string
                                                matched_offset:
                                                  type: number
                                        required:
                                          - analysis_ids
                                  required:
                                    - analysis_ids
                          suricata_alerts:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                                message:
                                  type: string
                                  example: ET DROP Spamhaus DROP Listed Traffic Inbound group 5
                                classification_type:
                                  type: string
                                  example: Misc Attack
                                destination_ip:
                                  type: string
                                  format: ipv4
                                destination_port:
                                  type: number
                                  minimum: 0
                                  maximum: 65535
                                source_ip:
                                  type: string
                                  format: ipv4
                                source_port:
                                  type: number
                                  minimum: 0
                                  maximum: 65535
                                protocol:
                                  type: string
                                  example: TCP
                                timestamp:
                                  type: string
                                  format: date-time
                                  example: '2025-01-02T10:51:04'
                                source_id:
                                  type: number
                                  example: 2400004
                              required:
                                - analysis_ids
                          bot_configurations:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                                botFamily:
                                  type: string
                                  example: Remcos
                                botServers:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      analysis_ids:
                                        type: array
                                        items:
                                          type: string
                                          format: uuid
                                      botServer:
                                        type: string
                                        example: wins.coemprsasltda.pro
                                    required:
                                      - analysis_ids
                                botFileName:
                                  type: string
                                  example: remcos.exe
                                botPassword:
                                  type: string
                                  example: 0
                                botRunMutex:
                                  type: string
                                  example: Rmc-3L7DW9
                                botInstallationPath:
                                  type: string
                                  example: Application path
                              required:
                                - analysis_ids
                      requested_hash:
                        type: string
                        format: sha1
                      private_data_filtered:
                        $ref: '#/components/schemas/private_data_filtered'
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The server has not found anything matching the Request URI. / Analysis Failed.
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/sha1/cac61424fb5414d589687bfd35452a351604ef11?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/sha1/cac61424fb5414d589687bfd35452a351604ef11"
            querystring = {"format":"json"}
            response = requests.get(url, querystring, auth=('username', 'password'))
            print(response.text)
  /api/dynamic/analysis/report/v1/query/{hash_type}/{hash_value}/{specific_report}:
    get:
      summary: 'TCA-0106: File/URL Dynamic Analysis Report (specific report)'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: get-api-dynamic-analysis-report-v1-query-hash_type-hash_value-specific_report
      parameters:
        - name: hash_type
          in: path
          required: true
          schema:
            type: string
            enum:
              - md5
              - sha1
              - sha256
          description: 'Required parameter. Specifies which hash type will be used in the request. Supported values: **md5**, **sha1**, **sha256**.'
        - $ref: '#/components/parameters/HashValue'
        - $ref: '#/components/parameters/response_format_JSON_default'
        - name: specific_report
          in: path
          required: true
          schema:
            oneOf:
              - title: Latest report
                type: string
                enum:
                  - latest
                description: The literal string "latest" returns the latest available report.
              - title: Analysis ID
                type: string
                format: uuid
                description: Specific report requested, for example `8c7fc224-60d6-469e-a36a-c90275cc01a0`.
          description: If added at the end of the request, the response will contain either the latest dynamic analysis report, or the report matching the provided analysis_id. These two parameters are mutually exclusive.
      description: The File and URL Dynamic Analysis Report service allows users to retrieve dynamic analysis reports for files and URLs executed in the cloud sandbox. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_hash: 734aaf5b557159d58dfc04d9eeecdbaafcfd2372
                      report:
                        analysis_id: 28f86ba6-aaa6-4a1f-90bb-a48a4fa65b00
                        md5: 2b7e5d3d7fd53274a61636bd7f5c35d9
                        sha1: 734aaf5b557159d58dfc04d9eeecdbaafcfd2372
                        sha256: e0c641e1d3b7c54d9cfa7ee5698fcfd61b230b0d59dd5672a969d651499e74c4
                        analysis_time: '2024-12-16T17:17:40'
                        classification: MALICIOUS
                        risk_score: 8
                        platform: windows11
                        configuration: MS Office 2016;Java 8;Adobe reader 21;Firefox 96;Google Chrome 113
                        browser: Google chrome 113
                        sample_name: yzlxnluza4
                        geolocation: us
                        locale: en-US
                        analysis_duration: 81
                        errors:
                          - 'System.Exception: Operation did not complete successfully because the file contains a virus or potentially unwanted software., copy target files'
                          - No process behavior to analyse as no analysis process or sample was found
                        threat_names:
                          - threat_name: Unknown
                        signatures:
                          - sig_id: 1532
                            risk_factor: 5
                            description: Sample is known by Antivirus
                          - sig_id: 621
                            risk_factor: 7
                            description: Uses 32bit PE files
                          - sig_id: 394
                            risk_factor: 7
                            description: Sample file is different than the original file name gathered from version info
                          - sig_id: 362
                            risk_factor: 10
                            description: Multi AV Scanner detection for the submitted file
                          - sig_id: 514
                            risk_factor: 7
                            description: PE file contains sections with non-standard names
                          - sig_id: 420
                            risk_factor: 5
                            description: Classification label
                          - sig_id: 1250
                            risk_factor: 7
                            description: Entrypoint lies outside standard sections
                      private_data_filtered: false
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - report
                      - requested_hash
                    properties:
                      requested_hash:
                        type: string
                      requested_id:
                        type: string
                        format: uuid
                      report:
                        type: object
                        properties:
                          md5:
                            type: string
                            format: md5
                          sha1:
                            type: string
                            format: sha1
                          sha256:
                            type: string
                            format: sha256
                          url:
                            type: string
                            format: url
                          url_base64:
                            type: string
                            format: base64
                          risk_score:
                            type: number
                            minimum: 0
                            maximum: 10
                            description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                          classification:
                            type: string
                            description: The classification of the sample.
                            enum:
                              - MALICIOUS
                              - SUSPICIOUS
                              - KNOWN
                              - UNKNOWN
                          interactive:
                            type: string
                            description: |
                              Whether this report is the result of an interactive session
                              from Spectra Analyze.
                            enum:
                              - 'true'
                              - 'false'
                          timeout:
                            type: number
                            description: The maximum configured time the sample was allowed to run on the VM.
                          analysis_id:
                            type: string
                            format: uuid
                          analysis_time:
                            type: string
                            format: date-time
                          analysis_duration:
                            type: number
                          browser:
                            type: string
                          configuration:
                            type: string
                            description: Sandbox configuration (installed software).
                          process_tree:
                            type: array
                            description: An entire process tree generated during sample execution, sorted in order.
                            items:
                              type: object
                          screenshots_data:
                            description: List of screenshots taken during execution.
                            type: array
                            items:
                              type: object
                          pcap:
                            type: string
                            format: url
                          memory_strings:
                            type: string
                            format: url
                          screenshots:
                            type: string
                            format: url
                          dropped_files_url:
                            type: string
                            format: url
                          behavioral:
                            type: array
                            items:
                              type: object
                          signatures:
                            type: array
                            items:
                              type: object
                              properties:
                                sig_id:
                                  type: string
                                description:
                                  type: string
                                risk_factor:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                          threat_names:
                            type: array
                            items:
                              type: object
                              properties:
                                threat_name:
                                  type: string
                          yara:
                            type: object
                          suricata_alerts:
                            type: array
                            items:
                              type: object
                          bot_configurations:
                            type: array
                            items:
                              type: object
                      private_data_filtered:
                        $ref: '#/components/schemas/private_data_filtered'
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The server has not found anything matching the Request URI. / Analysis Failed.
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/sha1/cac61424fb5414d589687bfd35452a351604ef11/latest?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/sha1/cac61424fb5414d589687bfd35452a351604ef11/latest?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/dynamic/analysis/report/v1/query/url/base64/{base64_value}:
    get:
      summary: 'TCA-0106: URL Dynamic Analysis Report (BASE64) (merged report)'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: get-api-dynamic-analysis-report-v1-query-url-base64-base64_value
      parameters:
        - name: base64_value
          in: path
          required: true
          schema:
            type: string
          description: Required parameter. This parameter expects a base64-encoded URL to generate a report of the analyzed URLs.
      description: The URL Dynamic Analysis Report (BASE64) service allows users to retrieve dynamic analysis reports for URLs executed in the cloud sandbox. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_base64_url: aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL1p1c3lha3UvTWFsd2FyZS1Db2xsZWN0aW9uLVBhcnQtMi9tYWluL1JBVC9OSlJhdC5leGU
                      report:
                        platforms:
                          - windows11
                        classification: MALICIOUS
                        first_analysis: '2024-12-18T14:05:15'
                        last_analysis: '2024-12-18T14:05:44'
                        history_analysis:
                          - analysis_id: 425978a3-fc10-42a4-8794-6e5a4f8aef63
                            analysis_time: '2024-12-18T14:05:15'
                            classification: MALICIOUS
                            platform: windows11
                            configuration: MS Office 2016;Java 8;Adobe reader 21;Firefox 96;Google Chrome 113
                            risk_score: 9
                            classification_version: 3
                            browser: Google chrome 113
                            sample_name: ''
                            geolocation: us
                            locale: en-US
                            analysis_duration: 197
                            warnings:
                              - 'Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe, MoNotificationUx.exe'
                              - 'Excluded IPs from analysis (whitelisted): 64.233.185.113, 64.233.185.100, 64.233.185.139, 64.233.185.101, 64.233.185.102, 64.233.185.138, 142.250.105.94, 64.233.177.84, 64.233.177.101, 64.233.177.138, 64.233.177.102, 64.233.177.139, 64.233.177.113, 64.233.177.100, 192.229.211.108, 199.232.214.172, 40.79.25.129, 40.69.75.248, 23.208.130.127, 108.177.122.94, 34.104.35.123, 23.219.162.32'
                              - 'Excluded domains from analysis (whitelisted): geover.prod.do.dsp.mp.microsoft.com, dl.delivery.mp.microsoft.com, kv501.prod.do.dsp.mp.microsoft.com, geo.prod.do.dsp.trafficmanager.net, slscr.update.microsoft.com, clientservices.googleapis.com, e10370.d.akamaiedge.net, cp501.prod.do.dsp.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, ocsp.digicert.com, login.live.com, tsfe.trafficmanager.net, ocsp.edge.digicert.com, update.googleapis.com, geover.prod.do.dsp.mp.microsoft.com.edgekey.net, wu-b-net.trafficmanager.net, dl.delivery.mp.microsoft.com.delivery.microsoft.com, dcat-f-nlu-net.trafficmanager.net, accounts.google.com, geo.prod.do.dsp.mp.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, dl.delivery.mp.microsoft.com-c.edgesuite.net, array616.prod.do.dsp.mp.microsoft.com, cp501.prod.do.dsp.mp.microsoft.com.edgekey.net, fe3cr.delivery.mp.microsoft.com, kv501.prod.do.dsp.mp.microsoft.com.edgekey.net, edgedl.me.gvt1.com, clients.l.google.com, tsfe.trafficshaping.dsp.mp.microsoft.com, a1683.dscd.akamai.net'
                              - Not all processes where analyzed, report is missing behavior information
                              - Report size getting too big, too many NtSetInformationFile calls found.
                          - analysis_id: ccd14e2b-47a6-4008-a39d-23d763adce9d
                            analysis_time: '2024-12-18T14:05:44'
                            classification: MALICIOUS
                            platform: windows11
                            configuration: MS Office 2016;Java 8;Adobe reader 21;Firefox 96;Google Chrome 113
                            risk_score: 9
                            classification_version: 3
                            browser: Google chrome 113
                            sample_name: ''
                            geolocation: us
                            locale: en-US
                            analysis_duration: 211
                            warnings:
                              - 'Max analysis timeout: 200s exceeded, the analysis took too long'
                              - 'Exclude process from analysis (whitelisted): SecurityHealthHost.exe, dllhost.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, svchost.exe'
                              - 'Excluded IPs from analysis (whitelisted): 13.71.55.58, 192.229.211.108, 199.232.214.172, 64.233.185.138, 64.233.185.101, 64.233.185.139, 64.233.185.102, 64.233.185.100, 64.233.185.113, 142.250.105.94, 64.233.177.84, 64.233.177.113, 64.233.177.101, 64.233.177.102, 64.233.177.100, 64.233.177.139, 64.233.177.138, 23.208.130.127, 23.219.162.89, 23.219.162.96'
                              - 'Excluded domains from analysis (whitelisted): geover.prod.do.dsp.mp.microsoft.com, dl.delivery.mp.microsoft.com, kv501.prod.do.dsp.mp.microsoft.com, slscr.update.microsoft.com, clientservices.googleapis.com, e10370.d.akamaiedge.net, cp501.prod.do.dsp.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, atm-settingsfe-prod-geo2.trafficmanager.net, redirector.gvt1.com, login.live.com, settings-prod-cin-2.centralindia.cloudapp.azure.com, geover.prod.do.dsp.mp.microsoft.com.edgekey.net, dl.delivery.mp.microsoft.com.delivery.microsoft.com, 1d.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, dcat-f-nlu-net.trafficmanager.net, geo.prod.do.dsp.mp.microsoft.com, accounts.google.com, 1D.tlu.dl.delivery.mp.microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, dl.delivery.mp.microsoft.com-c.edgesuite.net, cp501.prod.do.dsp.mp.microsoft.com.edgekey.net, fe3cr.delivery.mp.microsoft.com, dcat-b-tlu-net.trafficmanager.net, clients.l.google.com, tsfe.trafficshaping.dsp.mp.microsoft.com, a1683.dscd.akamai.net'
                              - Not all processes where analyzed, report is missing behavior information
                              - Report size getting too big, too many NtSetInformationFile calls found.
                        risk_score: 9
                        classification_version: 3
                        mitre_attack:
                          matrix_list:
                            - name: Enterprise
                              tactics:
                                tactic_list:
                                  - id: TA0002
                                    name: Execution
                                    techniques:
                                      technique_list:
                                        - id: T1106
                                          name: Native API
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  - id: TA0005
                                    name: Defense Evasion
                                    techniques:
                                      technique_list:
                                        - id: T1055
                                          name: Process Injection
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1036
                                          name: Masquerading
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1027.002
                                          name: Software Packing
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1070.004
                                          name: File Deletion
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  - id: TA0009
                                    name: Collection
                                    techniques:
                                      technique_list:
                                        - id: T1056
                                          name: Input Capture
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  - id: TA0007
                                    name: Discovery
                                    techniques:
                                      technique_list:
                                        - id: T1518.001
                                          name: Security Software Discovery
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1046
                                          name: Network Service Discovery
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  - id: TA0011
                                    name: Command and Control
                                    techniques:
                                      technique_list:
                                        - id: T1573
                                          name: Encrypted Channel
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1095
                                          name: Non-Application Layer Protocol
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1071
                                          name: Application Layer Protocol
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                        dropped_files:
                          - md5: 29a37b6532a7acefa7580b826f23f6dd
                            sha1: a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
                            sha256: 7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
                            file_name: Unconfirmed 171614.crdownload (copy)
                            file_path: C:\Users\user\Downloads
                            sample_type: PE/Exe
                            sample_size: '32256'
                            classification: MALICIOUS
                            analysis_ids:
                              - classification: MALICIOUS
                                analysis_id: 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - md5: 29a37b6532a7acefa7580b826f23f6dd
                            sha1: a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
                            sha256: 7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
                            file_name: dc72bd61-dc74-48ee-bfcf-66d71ce8f73e.tmp
                            file_path: C:\Users\user\Downloads
                            sample_type: PE/Exe
                            sample_size: '32256'
                            classification: MALICIOUS
                            analysis_ids:
                              - classification: MALICIOUS
                                analysis_id: 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - md5: 29a37b6532a7acefa7580b826f23f6dd
                            sha1: a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
                            sha256: 7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
                            file_name: 'Chrome Cache Entry: 47'
                            file_path: ''
                            sample_type: PE/Exe
                            sample_size: '32256'
                            classification: MALICIOUS
                            analysis_ids:
                              - classification: MALICIOUS
                                analysis_id: 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - md5: 8bd295a9f9925ced3e2783b04d334a0f
                            sha1: 36370730ce0686e4da61249227ffc536dd816151
                            sha256: 6dd66c783c607c9996801b831032096c92b771f5e76ed139d729db008ce46929
                            file_name: 8ebab6a6-1a26-4854-98e2-9b285e1bb34a.tmp
                            file_path: C:\Users\user\Downloads
                            sample_type: PE/Exe
                            sample_size: '10663'
                            classification: NO_THREATS_FOUND
                            analysis_ids:
                              - classification: UNKNOWN
                                analysis_id: ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - md5: 29a37b6532a7acefa7580b826f23f6dd
                            sha1: a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
                            sha256: 7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
                            file_name: Unconfirmed 574299.crdownload
                            file_path: C:\Users\user\Downloads
                            sample_type: PE/Exe
                            sample_size: '32256'
                            classification: MALICIOUS
                            analysis_ids:
                              - classification: MALICIOUS
                                analysis_id: ccd14e2b-47a6-4008-a39d-23d763adce9d
                        behavioral:
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe"  --start-maximized  "about:blank"'
                              process_id: 7592
                              parent_process_id: 7436
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_time: '2024-12-18T06:01:02'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \pipe
                                file_name: crashpad_7592_TTCNGSJHWJINVSTJ
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: icudtl.dat
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: KBDUS.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \pipe
                                file_name: wkssvc
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_100_percent.pak
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_200_percent.pak
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\locales
                                file_name: en-US.pak
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: resources.pak
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: ''
                                file_name: Nsi
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{BC670FD7-4912-4580-9ABD-8489B4C3A144}
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{3C403BDA-7CED-11EE-A033-806E6F6E6963}
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name not found
                              - file_path: C:\Windows\system32\drivers\etc
                                file_name: hosts
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32\drivers
                                file_name: etc
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \Device\DeviceApi
                                file_name: CMApi
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32\spool\drivers\color
                                file_name: sRGB Color Space Profile.icm
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \pipe
                                file_name: mojo.7592.1192.11932825096576703845
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \Device\DeviceApi
                                file_name: CMNotify
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \pipe
                                file_name: mojo.7592.1192.12572305856631247425
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome
                                file_name: Application
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Microsoft Office\Office16
                                file_name: VISSHE.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Microsoft Office\Office16
                                file_name: ONFILTER.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Common Files\Microsoft Shared\OFFICE16
                                file_name: msoshext.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Microsoft Office\Office16
                                file_name: msohevi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE16
                                file_name: WXPNSE.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: WindowsCodecsRaw.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: dlnashext.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: inetcomm.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: webcheck.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Common Files\System
                                file_name: wab32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: wshext.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Windows Defender
                                file_name: shellext.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: ntshrui.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: shell32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: WorkfoldersShell.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: USERENV.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: Secur32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: WINHTTP.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: DWrite.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: WINSPOOL.DRV
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dhcpcsvc.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: DPAPI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: SSPICLI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: WS2_32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: CRYPT32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: combase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: OLEAUT32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: WINTRUST.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: ole32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: MSASN1.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: win32u.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: gdi32full.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: GDI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: USER32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: uxtheme.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: dataexchange.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: twinapi.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dwmapi.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: ''
                                file_name: STORAGE#Volume#{3c403bdd-7ced-11ee-a033-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: Caches
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: ''
                                file_name: STORAGE#Volume#{3c403bdd-7ced-11ee-a033-806e6f6e6963}#00000018DA200000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: ''
                                file_name: STORAGE#Volume#{3c403bdd-7ced-11ee-a033-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32\en-US
                                file_name: SHELL32.dll.mui
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: Windows.StateRepositoryPS.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: Windows.FileExplorer.Common.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: iertutil.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows
                                file_name: system32
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: 'C:'
                                file_name: Windows
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\$RECYCLE.BIN
                                file_name: S-1-5-21-3573376691-1003541250-332242625-1001
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: coml2.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: WindowsCodecs.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: thumbcache.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: Explorer
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: c:\windows\system32\en-US
                                file_name: imageres.dll.mui
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32\SystemResources
                                file_name: imageres.dll.mui.mun
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object path not found
                              - file_path: c:\windows\SystemResources
                                file_name: imageres.dll.mun
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: policymanager.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: CryptoWinRT.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: cryptngc.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ncrypt.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: NTASN1.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: ngcksp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: PCPKsp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: tbs.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: ncryptprov.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ActXPrxy.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32\en-US
                                file_name: OLEACCRC.DLL.mui
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SystemTemp
                                file_name: scoped_dir7592_1519076950
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: BitsProxy.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\Downloads
                                file_name: dc72bd61-dc74-48ee-bfcf-66d71ce8f73e.tmp
                                action_type: file_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: Caches
                                action_type: file_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name collision
                              - file_path: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent
                                file_name: AutomaticDestinations
                                action_type: file_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name collision
                              - file_path: C:\Users
                                file_name: user
                                action_type: file_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name collision
                              - file_path: C:\Users\user\AppData
                                file_name: Local
                                action_type: file_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name collision
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: Explorer
                                action_type: file_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name collision
                              - file_path: C:\Windows\SystemTemp
                                file_name: scoped_dir7592_1519076950
                                action_type: file_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SystemTemp
                                file_name: chrome_BITS_7592_1706688084
                                action_type: file_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Local State~RF286ca.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
                                file_name: LOG.old~RF2890c.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
                                file_name: LOG.old~RF2895a.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db
                                file_name: LOG.old~RF2895a.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\discounts_db
                                file_name: LOG.old~RF2896a.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
                                file_name: LOG.old~RF2896a.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
                                file_name: LOG.old~RF28998.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
                                file_name: LOG.old~RF28998.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
                                file_name: LOG.old~RF289a8.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
                                file_name: LOG.old~RF289a8.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates
                                file_name: LOG.old~RF28998.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db
                                file_name: LOG.old~RF289c7.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
                                file_name: LOG.old~RF289e7.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 1acfef7b-0ecb-4136-9898-7937f370d0a0.tmp
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
                                file_name: Tabs_13372377672211931
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
                                file_name: LOG.old~RF28bac.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
                                file_name: LOG.old~RF28bbb.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
                                file_name: LOG.old~RF28bcb.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
                                file_name: LOG.old~RF28ef7.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
                                file_name: Session_13372377671447426
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: trusted_vault.pb~RF295ae.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
                                file_name: 967fb530-7dc7-449e-80a6-ed1e9882b08c
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: LOG.old~RF29e69.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics
                                file_name: BrowserMetrics-6762D59F-1DA8.pma
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: BrowserMetrics
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Local State~RF2adca.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Secure Preferences~RF2afbe.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
                                file_name: LOG.old~RF2afdd.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
                                file_name: LOG.old~RF2affd.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
                                file_name: LOG.old~RF2b02b.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
                                file_name: LOG.old~RF2b02b.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
                                file_name: LOG.old~RF2b06a.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences~RF2d8b2.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
                                file_name: the-real-index~RF2de6f.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: the-real-index~RF2df79.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0
                                file_name: 128.png
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0
                                file_name: dasherSettingSchema.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0
                                file_name: eventpage_bin_prod.js
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0
                                file_name: page_embed_script.js
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\af
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: af
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\am
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: am
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\ar
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: ar
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\az
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: az
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\be
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: be
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: ca
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\cy
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\da
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\es_419
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\fi
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: fi
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\fil
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\fr
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\hi
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\hr
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: id
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: is
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\km
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: lt
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales
                                file_name: lv
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\ml
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\mn
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\vi
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\zh_CN
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_metadata
                                file_name: computed_hashes.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_metadata
                                file_name: verified_contents.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0
                                file_name: _metadata
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi
                                file_name: 1.69.2_0
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions
                                file_name: ghbmnnjooekpmoecnnnilnnbdlolhkhi
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: craw_background.js
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: craw_window.js
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
                                file_name: craw_window.css
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: css
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
                                file_name: craw_window.html
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: html
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: flapper.gif
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: topbar_floating_button_maximize.png
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: da
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: hr
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: id
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: _locales
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata
                                file_name: computed_hashes.json
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: _metadata
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
                                file_name: 1.0.0.6_0
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions
                                file_name: nmmhkkegccagdldgiimedpiccmgmieda
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences~RF325d8.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Local State~RF325e8.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SystemTemp
                                file_name: scoped_dir7592_1519076950
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences~RF39b08.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Local State~RF3a113.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Local State
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 00a74244-b33e-4b39-9201-98cc4d510a6e.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\discounts_db
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\discounts_db
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database
                                file_name: 000001.dbtmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: temp-index
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gdaefkejpgkiemlaofpalmlakkmbjdnl
                                file_name: 000001.dbtmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: trusted_vault.pb
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 3e47067e-9aea-4ee3-9709-0fe0a295bf7d.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\Downloads
                                file_name: dc72bd61-dc74-48ee-bfcf-66d71ce8f73e.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 426dad7c-747f-4bc0-ad66-7bc0f26e811a.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Secure Preferences
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 40a1a42d-f61b-457c-b5fc-e077b6279857.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 0c06113a-8ef6-4fa0-955a-d1cac100394b.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: ae2344a9-042a-4eef-b5f8-b3269ff11e21.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
                                file_name: the-real-index
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
                                file_name: temp-index
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: the-real-index
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 031224c8-09af-4617-a261-a2d7b0ceb37b.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 8a7316c5-8200-48bf-bb7d-75d76f94cd83.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 380472a1-0faf-4484-848f-f7118cc4cd80.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: b18863a2-b4d9-4992-90a1-2ee887c9bf1a.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                            registry_actions:
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
                                action_type: key_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
                                action_type: key_value_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name not found
                                value: ''
                                value_name: extensions.settings
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\FirstNotDefault
                                action_type: key_value_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name not found
                                value: ''
                                value_name: S-1-5-21-3573376691-1003541250-332242625-1001
                            process_actions:
                              - path: unknown
                                action_type: process_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                action_type: process_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - path: unknown
                                action_type: process_terminated
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: process is terminating
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2156,i,3080863878966395974,9710723346392385943,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11'
                              process_id: 5904
                              parent_process_id: 7592
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_time: '2024-12-18T06:01:04'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \pipe
                                file_name: crashpad_7592_TTCNGSJHWJINVSTJ
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: icudtl.dat
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: v8_context_snapshot.bin
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_100_percent.pak
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_200_percent.pak
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\locales
                                file_name: en-US.pak
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: resources.pak
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32\drivers\etc
                                file_name: hosts
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32\drivers
                                file_name: etc
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: ''
                                file_name: Nsi
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{BC670FD7-4912-4580-9ABD-8489B4C3A144}
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{3C403BDA-7CED-11EE-A033-806E6F6E6963}
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name not found
                              - file_path: \Device\Afd
                                file_name: Endpoint
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \Device
                                file_name: RasAcd
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name not found
                              - file_path: \Device\Afd
                                file_name: AsyncConnectHlp
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: tzres.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: 128.0.6613.114
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: apphelp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: ntdll.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: KERNEL32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: KERNELBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: AcLayers.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: msvcrt.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHLWAPI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_elf.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: VERSION.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: bcryptprimitives.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \Device
                                file_name: CNG
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: sechost.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: RPCRT4.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ADVAPI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ucrtbase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: msvcp_win.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: shcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: WINMM.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dbghelp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: IPHLPAPI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: USERENV.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: Secur32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: WINHTTP.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: DWrite.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: WINSPOOL.DRV
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dhcpcsvc.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: DPAPI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: SSPICLI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: WS2_32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: CRYPT32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: combase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: OLEAUT32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: WINTRUST.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: ole32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: MSASN1.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: win32u.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: gdi32full.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: GDI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: USER32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: NSI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dhcpcsvc6.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: nlansp_c.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: DNSAPI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ole32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: rpcss.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: kernel.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: uxtheme.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: clbcatq.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: netprofm.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: npmproxy.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: mswsock.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: rasadhlp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: CRYPTBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \Device
                                file_name: KsecDD
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: ''
                                file_name: 'C:'
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: 'C:'
                                file_name: Users
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users
                                file_name: user
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user
                                file_name: AppData
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData
                                file_name: Local
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local
                                file_name: Google
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: ntmarta.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32\en-US
                                file_name: tzres.dll.mui
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: SCT Auditing Pending Reports~RF28f74.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: SCT Auditing Pending Reports~RF2905f.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: TransportSecurity~RF2bd0c.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: Network Persistent State~RF3ad96.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: SCT Auditing Pending Reports
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 8da9b12e-f54b-4aa3-90d4-d3cd39711ce5.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 7385116f-3afe-45c8-a979-0c7c93b22db1.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: TransportSecurity
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 6a6323c6-859e-407c-b949-21fda064bdf2.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: Network Persistent State
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: ffed0f13-35e6-437b-9370-d6f56494a55e.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://raw.githubusercontent.com/Zusyaku/Malware-Collection-Part-2/main/RAT/NJRat.exe"'
                              process_id: 2848
                              parent_process_id: 7436
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_time: '2024-12-18T06:01:08'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \pipe
                                file_name: crashpad_2848_WUBUHUMBNCCTMSYR
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files (x86)
                                file_name: AutoIt3
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: apphelp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: ntdll.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: KERNEL32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: KERNELBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: AcLayers.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: msvcrt.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHLWAPI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: 128.0.6613.114
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_elf.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: VERSION.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: bcryptprimitives.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \Device
                                file_name: CNG
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome
                                file_name: Application
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: sechost.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: RPCRT4.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ADVAPI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: ntmarta.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ucrtbase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: msvcp_win.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: shcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: win32u.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: gdi32full.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: GDI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: USER32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHELL32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: windows.storage.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: wintypes.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: combase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHCORE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: kernel.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                            process_actions:
                              - path: unknown
                                action_type: process_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                action_type: process_terminated
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe"  --start-maximized  "about:blank"'
                              process_id: 3800
                              parent_process_id: 3568
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_time: '2024-12-18T06:02:26'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: crashpad_3800_IZJXDIGCNNRLPQHX
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: icudtl.dat
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: KBDUS.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: wkssvc
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_100_percent.pak
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_200_percent.pak
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\locales
                                file_name: en-US.pak
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: resources.pak
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: ''
                                file_name: Nsi
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{BC670FD7-4912-4580-9ABD-8489B4C3A144}
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{3C403BDA-7CED-11EE-A033-806E6F6E6963}
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object name not found
                              - file_path: C:\Windows\system32\drivers\etc
                                file_name: hosts
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32\drivers
                                file_name: etc
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \Device\DeviceApi
                                file_name: CMApi
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32\spool\drivers\color
                                file_name: sRGB Color Space Profile.icm
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: mojo.3800.6804.3307714836146057942
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \Device\DeviceApi
                                file_name: CMNotify
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: mojo.3800.6804.18375675598685998179
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome
                                file_name: Application
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: MEIRYO.TTC
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: BIZ-UDGOTHICR.TTC
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: YUMIN.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: MALGUN.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: MSYH.TTC
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SIMSUN.TTC
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: MSJH.TTC
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: mojo.3800.6804.15510680939863896281
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: tzres.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
                                file_name: Google Chrome.lnk
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\resources\web_store\_metadata
                                file_name: computed_hashes.json
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object path not found
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\resources\pdf\_metadata
                                file_name: computed_hashes.json
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object path not found
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\resources\hangout_services\_metadata
                                file_name: computed_hashes.json
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object path not found
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\resources\network_speech_synthesis\_metadata
                                file_name: computed_hashes.json
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object path not found
                              - file_path: C:\Windows
                                file_name: SystemTemp
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\default_apps
                                file_name: external_extensions.json
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\WidevineCdm
                                file_name: manifest.json
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\PrivacySandboxAttestationsPreloaded
                                file_name: manifest.json
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\MEIPreload
                                file_name: manifest.json
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGOEUI.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGUISB.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: mojo.3800.6804.7082914767489340350
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: 128.0.6613.114
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: mojo.3800.6804.14046542917182055128
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: OLEACCRC.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: TIMES.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: TIMESBD.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: TIMESBI.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: TIMESI.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: mojo.3800.6804.4929495068947309308
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIAL.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dbghelp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SystemResources
                                file_name: USER32.dll.mun
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object name not found
                              - file_path: ''
                                file_name: STORAGE#Volume#{3c403bdd-7ced-11ee-a033-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: Caches
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: ''
                                file_name: STORAGE#Volume#{3c403bdd-7ced-11ee-a033-806e6f6e6963}#00000018DA200000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: ''
                                file_name: STORAGE#Volume#{3c403bdd-7ced-11ee-a033-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32\en-US
                                file_name: SHELL32.dll.mui
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: Windows.StateRepositoryPS.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.69.2_0\_locales\af
                                file_name: messages.json
                                action_type: file_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database
                                file_name: 000001.dbtmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: temp-index
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gdaefkejpgkiemlaofpalmlakkmbjdnl
                                file_name: 000001.dbtmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: trusted_vault.pb
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 95790560-9572-427a-bd76-901bbcd3082d.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: LOG.old
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: LOG
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\Downloads
                                file_name: 8ebab6a6-1a26-4854-98e2-9b285e1bb34a.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 91fef921-b0e7-4d2e-bc96-4e769c4fd4e4.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Secure Preferences
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 9252f56b-7296-47b7-9303-b4e939c3b7dd.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: cd85ae04-dd68-41d0-8bdf-a9c819cf6d25.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
                                file_name: the-real-index
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
                                file_name: temp-index
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: the-real-index
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 11a5d007-d8cc-4433-aa78-015ed9047505.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 21418c5b-d72f-4e9d-8422-76a1545363fc.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 72069458-c828-4bad-8c4e-6251e7993555.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                            registry_actions:
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
                                action_type: key_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
                                action_type: key_value_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object name not found
                                value: ''
                                value_name: extensions.settings
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\FirstNotDefault
                                action_type: key_value_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object name not found
                                value: ''
                                value_name: S-1-5-21-3573376691-1003541250-332242625-1001
                            process_actions:
                              - path: unknown
                                action_type: process_created
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                action_type: process_created
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - path: unknown
                                action_type: process_terminated
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: process is terminating
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2148,i,2195746873608610353,16668956073574200452,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11'
                              process_id: 3360
                              parent_process_id: 3800
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_time: '2024-12-18T06:02:29'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: crashpad_3800_IZJXDIGCNNRLPQHX
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: icudtl.dat
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: v8_context_snapshot.bin
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_100_percent.pak
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_200_percent.pak
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\locales
                                file_name: en-US.pak
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: resources.pak
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32\drivers\etc
                                file_name: hosts
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32\drivers
                                file_name: etc
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: ''
                                file_name: Nsi
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{BC670FD7-4912-4580-9ABD-8489B4C3A144}
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{3C403BDA-7CED-11EE-A033-806E6F6E6963}
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object name not found
                              - file_path: \Device\Afd
                                file_name: Endpoint
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \Device
                                file_name: RasAcd
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object name not found
                              - file_path: \Device\Afd
                                file_name: AsyncConnectHlp
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: tzres.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: 128.0.6613.114
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: apphelp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: ntdll.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: KERNEL32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: KERNELBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: AcLayers.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: msvcrt.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHLWAPI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_elf.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: VERSION.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: bcryptprimitives.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \Device
                                file_name: CNG
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: sechost.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: RPCRT4.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ADVAPI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ucrtbase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: msvcp_win.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: shcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dbghelp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: IPHLPAPI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: USERENV.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: Secur32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: WINHTTP.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: DWrite.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: WINSPOOL.DRV
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dhcpcsvc.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: WINMM.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: DPAPI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: SSPICLI.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: WS2_32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: CRYPT32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: combase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: OLEAUT32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: WINTRUST.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: ole32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: MSASN1.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: win32u.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: gdi32full.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: GDI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: USER32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: NSI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dhcpcsvc6.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: DNSAPI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: nlansp_c.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ole32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: rpcss.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: kernel.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: uxtheme.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: clbcatq.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: netprofm.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: npmproxy.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: mswsock.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: rasadhlp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: ''
                                file_name: 'C:'
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: 'C:'
                                file_name: Users
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users
                                file_name: user
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user
                                file_name: AppData
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData
                                file_name: Local
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local
                                file_name: Google
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: ntmarta.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: CRYPTBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \Device
                                file_name: KsecDD
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32\en-US
                                file_name: tzres.dll.mui
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: SCT Auditing Pending Reports~RF36cd4.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: SCT Auditing Pending Reports~RF36d22.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: TransportSecurity~RF3a51b.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: Network Persistent State~RF3a5b7.TMP
                                action_type: file_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: SCT Auditing Pending Reports
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 4caa457a-4728-443e-adc2-9fcc6ed22202.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 825c0246-0f63-4a09-8e2a-d6f5b8451267.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: TransportSecurity
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 09864459-7a0e-4597-834d-3509fe88b9de.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: Network Persistent State
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: c4c30492-d83b-4de5-ac94-c95da9884b74.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://raw.githubusercontent.com/Zusyaku/Malware-Collection-Part-2/main/RAT/NJRat.exe"'
                              process_id: 5256
                              parent_process_id: 3568
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_time: '2024-12-18T06:02:33'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: crashpad_5256_VQGGDZTOTZUTXDGB
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files (x86)
                                file_name: AutoIt3
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: apphelp.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: ntdll.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: KERNEL32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: KERNELBASE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: AcLayers.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: msvcrt.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHLWAPI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: 128.0.6613.114
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome_elf.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: VERSION.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: bcryptprimitives.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \Device
                                file_name: CNG
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome
                                file_name: Application
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: sechost.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: RPCRT4.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ADVAPI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: ntmarta.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ucrtbase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: msvcp_win.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: shcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: win32u.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: gdi32full.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: GDI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: USER32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHELL32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: IMM32.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: windows.storage.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: wintypes.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: combase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHCORE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: kernel.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                            process_actions:
                              - path: unknown
                                action_type: process_created
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                action_type: process_terminated
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                        network:
                          dns:
                            - type: A (IP address)
                              value: fp2e7a.wpc.phicdn.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 192.229.211.108
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.48.36
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 217.20.55.38
                              process_id: 0
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 185.199.111.133
                              process_id: 5904
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 217.20.55.35
                              process_id: 0
                            - type: CNAME (Canonical name)
                              value: edge.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: none
                              process_id: 0
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.104
                              process_id: 5904
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 185.199.108.133
                              process_id: 5904
                            - type: A (IP address)
                              value: fg.microsoft.map.fastly.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 199.232.214.172
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.55.36
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 217.20.48.24
                              process_id: 0
                            - type: A (IP address)
                              value: fg.microsoft.map.fastly.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 199.232.210.172
                              process_id: 0
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.103
                              process_id: 5904
                            - type: A (IP address)
                              value: bg.microsoft.map.fastly.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 199.232.210.172
                              process_id: 0
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 185.199.110.133
                              process_id: 5904
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.99
                              process_id: 5904
                            - type: A (IP address)
                              value: bg.microsoft.map.fastly.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 199.232.214.172
                              process_id: 0
                            - type: CNAME (Canonical name)
                              value: fp2e7a.wpc.2be4.phicdn.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: none
                              process_id: 0
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.147
                              process_id: 5904
                            - type: '65'
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: none
                              process_id: 5904
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 217.20.48.35
                              process_id: 0
                            - type: A (IP address)
                              value: wpad.example.org
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: none
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.55.20
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 217.20.48.19
                              process_id: 0
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.106
                              process_id: 5904
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 185.199.109.133
                              process_id: 5904
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.105
                              process_id: 5904
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.48.22
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.48.20
                              process_id: 0
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 108.177.122.104
                              process_id: 3360
                            - type: '65'
                              value: www.google.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: none
                              process_id: 3360
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 108.177.122.105
                              process_id: 3360
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 108.177.122.106
                              process_id: 3360
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 185.199.111.133
                              process_id: 3360
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 108.177.122.99
                              process_id: 3360
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.48.37
                              process_id: 0
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 185.199.108.133
                              process_id: 3360
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.48.39
                              process_id: 0
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 185.199.110.133
                              process_id: 3360
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.48.40
                              process_id: 0
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 108.177.122.103
                              process_id: 3360
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 108.177.122.147
                              process_id: 3360
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 185.199.109.133
                              process_id: 3360
                          tcp:
                            - destination_port: 443
                              destination_ip: 20.12.23.50
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 20.103.156.88
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 13.71.55.58
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 40.126.28.23
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 52.184.253.97
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 20.190.135.16
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 108.177.122.99
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 5904
                            - destination_port: 443
                              destination_ip: 185.199.110.133
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 5904
                            - destination_port: 443
                              destination_ip: 40.126.28.21
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 0
                            - destination_port: 80
                              destination_ip: 151.101.38.172
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 20.109.210.53
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 80
                              destination_ip: 199.232.210.172
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 185.199.108.133
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 3360
                            - destination_port: 80
                              destination_ip: 217.20.48.40
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 20.190.157.4
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 52.252.30.48
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 23.208.128.100
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 40.126.28.19
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 108.177.122.147
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 3360
                            - destination_port: 443
                              destination_ip: 52.158.246.138
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 40.79.25.129
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 443
                              destination_ip: 20.31.169.57
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                          udp:
                            - destination_port: 53
                              destination_ip: 8.8.8.8
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 5904
                            - destination_port: 53
                              destination_ip: 8.8.8.8
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 1900
                              destination_ip: 239.255.255.250
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_id: 7592
                            - destination_port: 1900
                              destination_ip: 239.255.255.250
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 3800
                            - destination_port: 53
                              destination_ip: 8.8.4.4
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 53
                              destination_ip: 8.8.8.8
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 3360
                            - destination_port: 53
                              destination_ip: 8.8.4.4
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 3360
                        signatures:
                          - sig_id: 1649
                            description: Found graphical window changes (likely an installer)
                            risk_factor: 0
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 487
                            description: Malicious sample detected (through community YARA rule)
                            risk_factor: 10
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1472
                            description: Drops files with a non matching file extension (content does not match to file extension)
                            risk_factor: 7
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - sig_id: 361
                            description: YARA signature match
                            risk_factor: 7
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1837
                            description: Contains functionality to log keystrokes (.Net Source)
                            risk_factor: 8
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 353
                            description: Performs DNS lookups
                            risk_factor: 5
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 420
                            description: Classification label
                            risk_factor: 5
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 392
                            description: Uses HTTPS
                            risk_factor: 5
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1549
                            description: Uses HTTPS for network communication
                            risk_factor: 5
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1271
                            description: Spawns processes
                            risk_factor: 5
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 472
                            description: Performs connections to IPs without corresponding DNS lookups
                            risk_factor: 5
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1524
                            description: Multi AV Scanner detection for dropped file
                            risk_factor: 10
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1167
                            description: Drops PE files
                            risk_factor: 7
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 358
                            description: May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)
                            risk_factor: 5
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1153
                            description: Deletes files inside the Windows folder
                            risk_factor: 7
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - sig_id: 1144
                            description: Creates files inside the system directory
                            risk_factor: 7
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - sig_id: 447
                            description: Sends SSDP (simple service discovery protocol) broadcast queries
                            risk_factor: 5
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 100059
                            description: Yara detected Njrat
                            risk_factor: 10
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1145
                            description: Creates files inside the user directory
                            risk_factor: 5
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1753
                            description: .NET source code contains potential unpacker
                            risk_factor: 8
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 508
                            description: Uses secure TLS version
                            risk_factor: 0
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - sig_id: 1729
                            description: .NET source code references suspicious native API functions
                            risk_factor: 8
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 530
                            description: PE file does not import any functions
                            risk_factor: 7
                            analysis_ids:
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 544
                            description: PE file overlay found
                            risk_factor: 7
                            analysis_ids:
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                        threat_names:
                          - threat_name: Njrat
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                        yara:
                          entries:
                            - source_type: dropped_file
                              source_name: C:\Users\user\Downloads\dc72bd61-dc74-48ee-bfcf-66d71ce8f73e.tmp
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              rule:
                                - description: Yara detected Njrat
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Detects NjRAT / Bladabindi
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27690
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: NjMgMDAgNkQgMDAgNjQgMDAgMkUgMDAgNjUgMDAgNzggMDAgNjUgMDAgMjAgMDAgMkYgMDAgNjMgMDAgMjAgMDAgNzAgMDAgNjkgMDAgNkUgMDAgNjc=
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: W2tsXQ==
                                      matched_offset: 27848
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: detect njRAT in memory
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbA==
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Windows_Trojan_Njrat_30f3c220
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: Z2V0X1JlZ2lzdHJ5
                                      matched_offset: 22375
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFtICI=
                                      matched_offset: 27690
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Detects malware from disclosed CN malware set
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: d2lubWdtdHM6XFwuXHJvb3RcU2VjdXJpdHlDZW50ZXIy
                                      matched_offset: 26716
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZWQgQXM=
                                      matched_offset: 27012
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U3R1Yi5leGU=
                                      matched_offset: 24499
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U2VsZWN0ICogRnJvbSBBbnRpVmlydXNQcm9kdWN0
                                      matched_offset: 26654
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Identify njRat
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: W1RBUF0=
                                      matched_offset: 27922
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5n
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                            - source_type: dropped_file
                              source_name: dropped/chromecache_47
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              rule:
                                - description: Yara detected Njrat
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Detects NjRAT / Bladabindi
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27690
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: NjMgMDAgNkQgMDAgNjQgMDAgMkUgMDAgNjUgMDAgNzggMDAgNjUgMDAgMjAgMDAgMkYgMDAgNjMgMDAgMjAgMDAgNzAgMDAgNjkgMDAgNkUgMDAgNjc=
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: W2tsXQ==
                                      matched_offset: 27848
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: detect njRAT in memory
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbA==
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Windows_Trojan_Njrat_30f3c220
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: Z2V0X1JlZ2lzdHJ5
                                      matched_offset: 22375
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFtICI=
                                      matched_offset: 27690
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Detects malware from disclosed CN malware set
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: d2lubWdtdHM6XFwuXHJvb3RcU2VjdXJpdHlDZW50ZXIy
                                      matched_offset: 26716
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZWQgQXM=
                                      matched_offset: 27012
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U3R1Yi5leGU=
                                      matched_offset: 24499
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U2VsZWN0ICogRnJvbSBBbnRpVmlydXNQcm9kdWN0
                                      matched_offset: 26654
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Identify njRat
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: W1RBUF0=
                                      matched_offset: 27922
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5n
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                            - source_type: dropped_file
                              source_name: C:\Users\user\Downloads\Unconfirmed 574299.crdownload
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              rule:
                                - description: Yara detected Njrat
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: Detects NjRAT / Bladabindi
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27690
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: NjMgMDAgNkQgMDAgNjQgMDAgMkUgMDAgNjUgMDAgNzggMDAgNjUgMDAgMjAgMDAgMkYgMDAgNjMgMDAgMjAgMDAgNzAgMDAgNjkgMDAgNkUgMDAgNjc=
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: W2tsXQ==
                                      matched_offset: 27848
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: detect njRAT in memory
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbA==
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: Windows_Trojan_Njrat_30f3c220
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: Z2V0X1JlZ2lzdHJ5
                                      matched_offset: 22375
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFtICI=
                                      matched_offset: 27690
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: Detects malware from disclosed CN malware set
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: d2lubWdtdHM6XFwuXHJvb3RcU2VjdXJpdHlDZW50ZXIy
                                      matched_offset: 26716
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZWQgQXM=
                                      matched_offset: 27012
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: U3R1Yi5leGU=
                                      matched_offset: 24499
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: U2VsZWN0ICogRnJvbSBBbnRpVmlydXNQcm9kdWN0
                                      matched_offset: 26654
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: Identify njRat
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: W1RBUF0=
                                      matched_offset: 27922
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5n
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                        url: https://raw.githubusercontent.com/Zusyaku/Malware-Collection-Part-2/main/RAT/NJRat.exe
                        url_base64: aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL1p1c3lha3UvTWFsd2FyZS1Db2xsZWN0aW9uLVBhcnQtMi9tYWluL1JBVC9OSlJhdC5leGU
                        md5: ''
                        sha256: ''
                        sha1: f1e430ab96581ad37b2a24c03aece8b3a7059ae1
                      private_data_filtered: false
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - report
                      - requested_base64_url
                      - private_data_filtered
                    properties:
                      report:
                        type: object
                        properties:
                          md5:
                            type: string
                            format: md5
                          sha1:
                            type: string
                            format: sha1
                          sha256:
                            type: string
                            format: sha256
                          url:
                            type: string
                            format: url
                          url_base64:
                            type: string
                            format: base64
                          risk_score:
                            type: number
                            minimum: 0
                            maximum: 10
                            description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                          classification:
                            type: string
                            description: The classification of the sample.
                            enum:
                              - MALICIOUS
                              - SUSPICIOUS
                              - KNOWN
                              - UNKNOWN
                          interactive:
                            type: string
                            description: |
                              Whether this report is the result of an interactive session
                              from Spectra Analyze.
                            enum:
                              - 'true'
                              - 'false'
                          timeout:
                            type: number
                            description: The maximum configured time the sample was allowed to run on the VM.
                          classification_version:
                            type: number
                          first_analysis:
                            type: string
                            format: date-time
                          last_analysis:
                            type: string
                            format: date-time
                          history_analysis:
                            type: array
                            description: An object containing an overview of all available reports.
                            items:
                              type: object
                              properties:
                                analysis_id:
                                  type: string
                                  description: The analysis ID of the report.
                                analysis_time:
                                  type: string
                                  description: The date and time of the analysis.
                                  format: date-time
                                classification:
                                  type: string
                                  description: The classification of the sample.
                                  enum:
                                    - MALICIOUS
                                    - SUSPICIOUS
                                    - KNOWN
                                    - UNKNOWN
                                platform:
                                  type: string
                                  description: The platform used to analyze the sample.
                                configuration:
                                  type: string
                                  description: A short description of the platform configuration specifics (for example, "Win10 x64, Office 2016, Java 8 Update 191").
                                optional_parameters:
                                  type: string
                                  enum:
                                    - internet_simulation=true
                                    - internet_simulation=false
                                  example: internet_simulation=false
                                risk_score:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                                  description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                                classification_version:
                                  type: number
                                browser:
                                  type: string
                                  description: Browser used in the sandbox.
                                sample_name:
                                  type: string
                                  description: Custom file name and/or extension provided on submission. Custom extensions impact which application was used to open and run the file.
                                geolocation:
                                  type: string
                                  description: Geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods.
                                  default: us
                                  enum:
                                    - us
                                    - uk
                                    - in
                                    - br
                                    - de
                                    - jp
                                    - sg
                                    - it
                                    - es
                                    - fr
                                    - tor
                                locale:
                                  type: string
                                  description: The configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes.
                                  default: en-US
                                  enum:
                                    - en-US
                                    - en-GB
                                    - pt-BR
                                    - de-DE
                                    - ja-JP
                                    - it-IT
                                    - es-ES
                                    - fr-FR
                                analysis_duration:
                                  type: number
                                  description: The duration of the analysis (in seconds).
                                warnings:
                                  type: array
                                  items:
                                    type: string
                                errors:
                                  type: array
                                  items:
                                    type: string
                                pcap:
                                  type: string
                                  format: url
                                memory_strings:
                                  type: string
                                  format: url
                                screenshots:
                                  type: string
                                  format: url
                                dropped_files:
                                  type: string
                                  format: url
                          platforms:
                            type: array
                            description: Platforms used to analyze the sample.
                            items:
                              type: string
                              enum:
                                - windows7
                                - windows10
                                - macos11
                          behavioral:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                          signatures:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                                sig_id:
                                  type: string
                                description:
                                  type: string
                                risk_factor:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                              required:
                                - analysis_ids
                          threat_names:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                                threat_name:
                                  type: string
                              required:
                                - analysis_ids
                          yara:
                            type: object
                            properties:
                              entries:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    analysis_ids:
                                      type: array
                                      items:
                                        type: string
                                        format: uuid
                                  required:
                                    - analysis_ids
                          suricata_alerts:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                              required:
                                - analysis_ids
                          bot_configurations:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                              required:
                                - analysis_ids
                      requested_base64_url:
                        type: string
                        format: base64
                      private_data_filtered:
                        $ref: '#/components/schemas/private_data_filtered'
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/url/base64/aHR0cDovLzE5My4yNS4yMjAuMjMxLw' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/url/base64/aHR0cDovL3d3dy5nb29nbGUuY29t"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/dynamic/analysis/report/v1/query/url/base64/{base64_value}/{specific_report}:
    get:
      summary: 'TCA-0106: URL Dynamic Analysis Report (BASE64) (specific report)'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: get-api-dynamic-analysis-report-v1-query-url-base64-base64_value-specific_report
      parameters:
        - name: base64_value
          in: path
          required: true
          schema:
            type: string
          description: Required parameter. This parameter expects a base64-encoded URL to generate a report of the analyzed URLs.
        - name: specific_report
          in: path
          required: true
          schema:
            oneOf:
              - type: string
                enum:
                  - latest
                description: '`latest`: incompatible and mutually exclusive with `analysis_id`.'
              - type: string
                description: '`analysis_id`: incompatible and mutually exclusive with `latest`.'
          description: If added at the end of the request, the response will contain either the latest dynamic analysis report, or the report matching the provided analysis_id. These two parameters are mutually exclusive.
      description: The URL Dynamic Analysis Report (BASE64) service allows users to retrieve dynamic analysis reports for URLs executed in the cloud sandbox. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_base64_url: aHR0cDovL3d3dy5nb29nbGUuY29t
                      report:
                        analysis_id: 654fdd3d-5bde-4679-8cc0-cfbb31735e17
                        md5: ''
                        sha1: ac4cbe16220c61319d192bf9078f01de42e383e3
                        sha256: ''
                        url: http://google.com/
                        url_base64: aHR0cDovL2dvb2dsZS5jb20v
                        analysis_time: '2025-01-22T12:44:52'
                        classification: NO_THREATS_FOUND
                        risk_score: 0
                        platform: windows10
                        configuration: MS Office 2016;Java 8;Adobe reader 2024;Firefox 63;Google Chrome 104
                        browser: Google chrome 104
                        sample_name: ''
                        geolocation: us
                        locale: en-US
                        timeout: '200'
                        process_tree:
                          - name: chrome.exe
                            parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe"  --start-maximized  "about:blank"'
                            process_id: 7024
                            parent_process_id: 796
                          - name: chrome.exe
                            parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=1976,i,4189547056130036384,10463305730677613153,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241110-180057.762000 --mojo-platform-channel-handle=2072 /prefetch:3'
                            process_id: 3664
                            parent_process_id: 7024
                          - name: chrome.exe
                            parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://google.com/"'
                            process_id: 6216
                            parent_process_id: 796
                        analysis_duration: 200
                        warnings:
                          - 'Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, MusNotifyIcon.exe, conhost.exe, slui.exe, svchost.exe'
                          - 'Excluded IPs from analysis (whitelisted): 40.126.28.19, 40.126.28.13, 20.190.135.16, 20.190.135.7, 20.190.135.3, 20.190.135.2, 20.190.135.4, 40.126.28.23, 142.250.9.113, 142.250.9.139, 142.250.9.138, 142.250.9.100, 142.250.9.102, 142.250.9.101, 74.125.138.94, 172.217.215.84, 172.217.215.100, 172.217.215.113, 172.217.215.139, 172.217.215.101, 172.217.215.138, 172.217.215.102, 172.253.124.94, 74.125.138.95, 172.217.215.95, 108.177.122.95, 142.250.105.95, 64.233.185.95, 173.194.219.95, 172.253.124.95, 142.250.9.95, 172.217.215.94, 108.177.122.94, 142.250.105.207, 173.194.219.207, 64.233.185.207, 74.125.138.207, 172.253.124.207, 172.217.215.207, 108.177.122.207, 142.250.9.207, 142.250.9.97, 108.177.122.139, 108.177.122.101, 108.177.122.102, 108.177.122.138, 108.177.122.100, 108.177.122.113, 108.177.122.120, 142.250.105.94, 34.104.35.123, 108.177.122.97'
                          - 'Excluded domains from analysis (whitelisted): ssl.gstatic.com, storage.googleapis.com, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, clients2.google.com, redirector.gvt1.com, login.live.com, www.googletagmanager.com, update.googleapis.com, www.gstatic.com, www.google-analytics.com, prdv4a.aadg.msidentity.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, ajax.googleapis.com, activation-v2.sls.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, settings-win.data.microsoft.com, ctldl.windowsupdate.com, ogads-pa.googleapis.com, login.msa.msidentity.com, ssl.google-analytics.com, licensing.mp.microsoft.com, edgedl.me.gvt1.com, gstatic.com, clients.l.google.com'
                          - Not all processes where analyzed, report is missing behavior information
                          - Report size exceeded maximum capacity and may have missing network information.
                          - Report size getting too big, too many NtCreateFile calls found.
                          - Report size getting too big, too many NtSetInformationFile calls found.
                        screenshots_data:
                          - screenshot_time: '2025-01-22T01:40:26'
                            name: 0.jpg
                          - screenshot_time: '2025-01-22T01:40:28'
                            name: 1.jpg
                          - screenshot_time: '2025-01-22T01:40:31'
                            name: 2.jpg
                          - screenshot_time: '2025-01-22T01:40:36'
                            name: 3.jpg
                        threat_names:
                          - threat_name: Unknown
                        dropped_files:
                          - md5: e34ecdb5c583d16f159629f66c09935f
                            sha1: 6274e580fb0b3febbf3a0e57734510a65c8e2197
                            sha256: 4e7b825230019c3bbff1eccc06c6c6b73c7936bf62a1ee4839a03a75c27264e7
                            file_name: 'Chrome Cache Entry: 492'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '151'
                            classification: NO_THREATS_FOUND
                          - md5: 6e86b5d8fda3e4245617f60d4c190c0f
                            sha1: 82e65dd78abd43c9829b272b344c1d1743bf84ac
                            sha256: eb7259403330bf8f16359d98b133bd5b2f681444bbccea61278b0a890e69266a
                            file_name: 'Chrome Cache Entry: 506'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '274'
                            classification: NO_THREATS_FOUND
                          - md5: 48b46c0b5c0776da19144ce3527e77f8
                            sha1: 7b2f5409fdcf0e0f0f78526b8a9ebd285d21844f
                            sha256: a7b61aad39079a24efd589452e75e2acccdc864726afc70ebef15a478fe798b2
                            file_name: 'Chrome Cache Entry: 727'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '440'
                            classification: NO_THREATS_FOUND
                          - md5: 602184f952b7233e0d176c7ae34ac9d1
                            sha1: 66f4d6b5fa5d90ba664494a1f0bbb6bbf7bf9cb2
                            sha256: 65a78971dac5204451b0e89068ba0e04184cb5eb0decaf99503559c771aba012
                            file_name: 'Chrome Cache Entry: 265'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '521'
                            classification: NO_THREATS_FOUND
                          - md5: 0665ae79440bf663a2aff2e7cef339e1
                            sha1: 5f644a7b31421e775a570b0744acc61cf1f14939
                            sha256: 5344e32cb92f42f62909c2ad84e7104cda2ebd0c75245145802e119cccb691e1
                            file_name: 'Chrome Cache Entry: 266'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '42'
                            classification: NO_THREATS_FOUND
                          - md5: c368be0062d64da9636d9d8652dff7c7
                            sha1: eddf5f91683c626d474a8c1f582e04ac9a1890ad
                            sha256: 67a9de65373797213f6e0cbe22b07520385d1b8f3cb7b98a9dbbdea18b862b16
                            file_name: 'Chrome Cache Entry: 631'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '4713'
                            classification: NO_THREATS_FOUND
                          - md5: e3450e4e500578c8b83d5fa6c7effc90
                            sha1: 86791163fb6196918a1be55d2648ec239a9c02f6
                            sha256: 93bba14f888ba5852ea27e37b3221ab1a4183d7ba99c790cbd1079dbc22ef12d
                            file_name: 'Chrome Cache Entry: 744'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '1682'
                            classification: NO_THREATS_FOUND
                        signatures:
                          - sig_id: 1649
                            risk_factor: 0
                            description: Found graphical window changes (likely an installer)
                          - sig_id: 353
                            risk_factor: 5
                            description: Performs DNS lookups
                          - sig_id: 420
                            risk_factor: 5
                            description: Classification label
                          - sig_id: 392
                            risk_factor: 5
                            description: Uses HTTPS
                        network:
                          dns:
                            - type: A (IP address)
                              value: stats.g.doubleclick.net
                              address: 172.253.124.157
                              process_id: 3664
                            - type: A (IP address)
                              value: ad.doubleclick.net
                              address: 64.233.185.149
                              process_id: 3664
                            - type: A (IP address)
                              value: workspace.google.com
                              address: 64.233.185.139
                              process_id: 3664
                            - type: CNAME (Canonical name)
                              value: lh3.googleusercontent.com
                              address: none
                              process_id: 3664
                            - type: A (IP address)
                              value: adservice.google.com
                              address: 173.194.219.157
                              process_id: 3664
                            - type: A (IP address)
                              value: www3.l.google.com
                              address: 108.177.122.138
                              process_id: 3664
                            - type: A (IP address)
                              value: td.doubleclick.net
                              address: 108.177.122.154
                              process_id: 3664
                            - type: A (IP address)
                              value: stats.g.doubleclick.net
                              address: 172.253.124.154
                              process_id: 3664
                            - type: A (IP address)
                              value: analytics.google.com
                              address: 74.125.138.101
                              process_id: 3664
                            - type: A (IP address)
                              value: dart.l.doubleclick.net
                              address: 64.233.185.148
                              process_id: 3664
                          tcp:
                            - destination_port: 443
                              destination_ip: 173.194.219.141
                              process_id: 3664
                            - destination_port: 443
                              destination_ip: 74.125.138.139
                              process_id: 3664
                            - destination_port: 443
                              destination_ip: 172.253.124.97
                              process_id: 3664
                        behavioral:
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe"  --start-maximized  "about:blank"'
                              process_id: 7024
                              parent_process_id: 796
                              process_time: '2025-01-22T13:40:27'
                            file_actions:
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: crashpad_7024_AZBPLDTQFSFZNVLB
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome.dll
                                status: success or wait
                                action_type: file_opened
                            registry_actions:
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_deleted
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
                                status: object name not found
                                value_name: extensions.settings
                                value: ''
                                action_type: key_value_deleted
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\FirstNotDefault
                                status: object name not found
                                value_name: S-1-5-21-723508380-312941994-2342154681-1001
                                value: ''
                                action_type: key_value_deleted
                            process_actions:
                              - path: unknown
                                status: success or wait
                                action_type: process_created
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                status: success or wait
                                action_type: process_created
                              - path: unknown
                                status: process is terminating
                                action_type: process_terminated
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=1976,i,4189547056130036384,10463305730677613153,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241110-180057.762000 --mojo-platform-channel-handle=2072 /prefetch:3'
                              process_id: 3664
                              parent_process_id: 7024
                              process_time: '2025-01-22T13:40:28'
                            file_actions:
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: crashpad_7024_AZBPLDTQFSFZNVLB
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: chrome.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: \Device\DeviceApi
                                file_name: CMApi
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114
                                file_name: icudtl.dat
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: Network Persistent State
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: c045e810-46cc-43ab-94e1-bd0e62b32dc7.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 351e62f7-550c-4aee-9541-b66dcb343986.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 8011358f-1b8c-4d04-818c-911d3397d97a.tmp
                                status: success or wait
                                action_type: file_moved
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://google.com/"'
                              process_id: 6216
                              parent_process_id: 796
                              process_time: '2025-01-22T13:40:30'
                            file_actions:
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: crashpad_6216_KPBNPSSIXLXFWQDW
                                status: success or wait
                                action_type: file_opened
                              - file_path: \Device\DeviceApi
                                file_name: CMApi
                                status: success or wait
                                action_type: file_opened
                            process_actions:
                              - path: unknown
                                status: success or wait
                                action_type: process_created
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                status: success or wait
                                action_type: process_terminated
                        mitre_attack:
                          matrix_list:
                            - tactics:
                                tactic_list:
                                  - techniques:
                                      technique_list:
                                        - id: T1055
                                          name: Process Injection
                                        - id: T1036
                                          name: Masquerading
                                    name: Defense Evasion
                                    id: TA0003
                                  - techniques:
                                      technique_list:
                                        - id: T1046
                                          name: Network Service Scanning
                                    name: Discovery
                                    id: TA0005
                                  - techniques:
                                      technique_list:
                                        - id: T1071
                                          name: Application Layer Protocol
                                        - id: T1095
                                          name: Non-Application Layer Protocol
                                        - id: T1573
                                          name: Encrypted Channel
                                    name: Command and Control
                                    id: TA0009
                                  - techniques:
                                      technique_list: []
                                    name: Privilege Escalation
                                    id: TA0002
                                  - techniques:
                                      technique_list: []
                                    name: Credential Access
                                    id: TA0004
                                  - techniques:
                                      technique_list: []
                                    name: Discovery
                                    id: TA0007
                                  - techniques:
                                      technique_list: []
                                    name: Privilege Escalation
                                    id: TA0004
                              name: Enterprise
                        pcap: https://bucket.reversinglabs.com/rl-cloud-sandbox-pcap-prod/ac4cbe16220c61319d192bf9078f01de42e383e3_654fdd3d-5bde-4679-8cc0-cfbb31735e17_pcap_windows10.7z?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=8WrLFV1jWsk6RFDt%2F20250127%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250127T093910Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=0f501f128ff18b4354231b3c3ef53654d004bd2f5ce76caf801fc14bc8f103c8
                        memory_strings: https://bucket.reversinglabs.com/rl-cloud-sandbox-memstrings-prod/ac4cbe16220c61319d192bf9078f01de42e383e3_654fdd3d-5bde-4679-8cc0-cfbb31735e17_memstrings_windows10.7z?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=8WrLFV1jWsk6RFDt%2F20250127%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250127T093910Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=9b788798de0e6cd77caa467cd5e559a0f9c170dcd0eb6b5054b79223271395aa
                        screenshots: https://bucket.reversinglabs.com/rl-cloud-sandbox-screenshots-prod/ac4cbe16220c61319d192bf9078f01de42e383e3_654fdd3d-5bde-4679-8cc0-cfbb31735e17_screenshots_windows10.7z?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=8WrLFV1jWsk6RFDt%2F20250127%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250127T093910Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=50b879bfcb908241704b2ea0ebe18b7a6e19606814b21cd3d8edf748b015c31a
                        dropped_files_url: https://bucket.reversinglabs.com/rl-cloud-sandbox-dropped-prod/ac4cbe16220c61319d192bf9078f01de42e383e3_654fdd3d-5bde-4679-8cc0-cfbb31735e17_dropped_windows10.7z?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=8WrLFV1jWsk6RFDt%2F20250127%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250127T093910Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=2a638a8bbc57226bf87dcd4bb02e3382a50ebfd9a51ff64f2293abbc9fc84d5a
                      private_data_filtered: false
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - report
                      - requested_base64_url
                      - private_data_filtered
                      - requested_id
                    properties:
                      requested_base64_url:
                        type: string
                        format: base64
                      requested_id:
                        type: string
                        format: uuid
                      report:
                        type: object
                        properties:
                          md5:
                            type: string
                            format: md5
                          sha1:
                            type: string
                            format: sha1
                          sha256:
                            type: string
                            format: sha256
                          url:
                            type: string
                            format: url
                          url_base64:
                            type: string
                            format: base64
                          risk_score:
                            type: number
                            minimum: 0
                            maximum: 10
                            description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                          classification:
                            type: string
                            description: The classification of the sample.
                            enum:
                              - MALICIOUS
                              - SUSPICIOUS
                              - KNOWN
                              - UNKNOWN
                          interactive:
                            type: string
                            description: |
                              Whether this report is the result of an interactive session
                              from Spectra Analyze.
                            enum:
                              - 'true'
                              - 'false'
                          timeout:
                            type: number
                            description: The maximum configured time the sample was allowed to run on the VM.
                          analysis_id:
                            type: string
                            format: uuid
                          analysis_time:
                            type: string
                            format: date-time
                          analysis_duration:
                            type: number
                          android_behavioral:
                            type: object
                            description: Android-specific dynamic analysis information.
                            properties:
                              dynamic_services:
                                type: array
                                description: List of dynamically started services.
                                items:
                                  type: string
                                  example: Intent { cmp=cmf0.c3b5bm90zq.patch/.C11 }
                              dynamic_receivers:
                                type: array
                                description: List of dynamically registered broadcast receivers.
                                items:
                                  type: object
                                  properties:
                                    name:
                                      type: string
                                      description: Runtime-registered receiver class name.
                                    intents:
                                      type: array
                                      description: Intent actions the receiver handles.
                                      items:
                                        type: string
                                        example: android.intent.action.BATTERY_CHANGED
                              permissions_executed:
                                type: array
                                description: Permissions actually executed during dynamic analysis.
                                items:
                                  type: object
                                  properties:
                                    name:
                                      type: string
                                      description: Permission name.
                                      example: ACCESS_NETWORK_STATE
                                    executed:
                                      type: boolean
                                      description: Whether the permission was actually used at runtime.
                                      example: true
                          browser:
                            type: string
                          configuration:
                            type: string
                            description: Sandbox configuration (installed software).
                          optional_parameters:
                            type: string
                            description: If the `internet_simulation` parameter is set to `true`, dynamic analysis was performed without connecting to the internet and a simulated network was used instead. If this value is false, the report is the same as if the parameter is omitted from the response. HTTPS traffic information is not monitored during analysis when `internet_simulation` is set to true.
                          process_tree:
                            type: array
                            description: An entire process tree generated during sample execution, sorted in order.
                            items:
                              type: object
                              properties:
                                name:
                                  type: string
                                  example: WINWORD.EXE
                                parameters:
                                  type: string
                                  example: '"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE" /Automation -Embedding'
                                process_id:
                                  type: number
                                  example: 8556
                                parent_process_id:
                                  type: number
                                  example: 820
                          screenshots_data:
                            description: List of screenshots taken during execution.
                            type: array
                            items:
                              type: object
                              properties:
                                screenshot_time:
                                  type: string
                                  format: date-time
                                name:
                                  type: string
                                  example: 0.jpg
                          pcap:
                            type: string
                            format: url
                            description: Contains a link to download the PCAP file with all the network traffic generated during sample execution. PCAP files have a retention period of 14 days. This link is generated when the report is requested, and expires in 1 hour.
                          memory_strings:
                            type: string
                            format: url
                            description: Contains a link to download a dump of memory strings stored in the memory and captured during file execution. Memory strings have a retention period of 14 days. This link is generated when the report is requested, and expires in 1 hour.
                          screenshots:
                            type: string
                            format: url
                            description: Contains a link to screenshots collected during the analysis. Screenshots have a retention period of 14 days. This link is generated when the report is requested, and expires in 1 hour.
                          dropped_files_url:
                            type: string
                            format: url
                            description: Contains a link to files dropped during the analysis. Screenshots have a retention period of 14 days. This link is generated when the report is requested, and expires in 1 hour.
                          behavioral:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            description: Behavioral information about the executed sample. Every object relates one process spawned during sample execution to specific actions it performed.
                            items:
                              type: object
                          signatures:
                            description: Abstracted behaviors, attributes, and content identified during analysis. Each signature has a signature ID, description and a risk score.
                            type: array
                            items:
                              type: object
                              properties:
                                sig_id:
                                  type: string
                                  description: Signature ID
                                description:
                                  type: string
                                  description: Signature description in human readable form
                                risk_factor:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                                  description: '[Risk factor](/General/AnalysisAndClassification/Classification#risk-score) assigned to this signature.'
                          threat_names:
                            type: array
                            items:
                              type: object
                              properties:
                                threat_name:
                                  type: string
                                  description: Detected threat in the sample.
                          yara:
                            type: object
                            properties:
                              entries:
                                type: array
                                items:
                                  type: object
                          suricata_alerts:
                            type: array
                            items:
                              type: object
                          bot_configurations:
                            type: array
                            items:
                              type: object
                      private_data_filtered:
                        $ref: '#/components/schemas/private_data_filtered'
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/url/base64/aHR0cDovLzE5My4yNS4yMjAuMjMxLw/latest' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/url/base64/aHR0cDovL3d3dy5nb29nbGUuY29t/latest"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/dynamic/analysis/report/v1/query/url/sha1/{sha1_value}:
    get:
      summary: 'TCA-0106: URL Dynamic Analysis Report (SHA1) (merged report)'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: get-api-dynamic-analysis-report-v1-query-url-sha1-sha1_value
      parameters:
        - name: sha1_value
          in: path
          required: true
          schema:
            type: string
          description: Required parameter. This parameter expects a SHA1 hash value to generate a report of the analyzed URLs.
      description: The URL Dynamic Analysis Report (SHA1) service allows users to retrieve dynamic analysis reports for URLs executed in the cloud sandbox. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_sha1_url: f1e430ab96581ad37b2a24c03aece8b3a7059ae1
                      report:
                        platforms:
                          - windows11
                        classification: MALICIOUS
                        first_analysis: '2024-12-18T14:05:15'
                        last_analysis: '2024-12-18T14:05:44'
                        history_analysis:
                          - analysis_id: 425978a3-fc10-42a4-8794-6e5a4f8aef63
                            analysis_time: '2024-12-18T14:05:15'
                            classification: MALICIOUS
                            platform: windows11
                            configuration: MS Office 2016;Java 8;Adobe reader 21;Firefox 96;Google Chrome 113
                            risk_score: 9
                            classification_version: 3
                            browser: Google chrome 113
                            sample_name: ''
                            geolocation: us
                            locale: en-US
                            analysis_duration: 197
                            warnings:
                              - 'Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe, MoNotificationUx.exe'
                              - 'Excluded IPs from analysis (whitelisted): 64.233.185.113, 64.233.185.100, 64.233.185.139, 64.233.185.101, 64.233.185.102, 64.233.185.138, 142.250.105.94, 64.233.177.84, 64.233.177.101, 64.233.177.138, 64.233.177.102, 64.233.177.139, 64.233.177.113, 64.233.177.100, 192.229.211.108, 199.232.214.172, 40.79.25.129, 40.69.75.248, 23.208.130.127, 108.177.122.94, 34.104.35.123, 23.219.162.32'
                              - 'Excluded domains from analysis (whitelisted): geover.prod.do.dsp.mp.microsoft.com, dl.delivery.mp.microsoft.com, kv501.prod.do.dsp.mp.microsoft.com, geo.prod.do.dsp.trafficmanager.net, slscr.update.microsoft.com, clientservices.googleapis.com, e10370.d.akamaiedge.net, cp501.prod.do.dsp.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, ocsp.digicert.com, login.live.com, tsfe.trafficmanager.net, ocsp.edge.digicert.com, update.googleapis.com, geover.prod.do.dsp.mp.microsoft.com.edgekey.net, wu-b-net.trafficmanager.net, dl.delivery.mp.microsoft.com.delivery.microsoft.com, dcat-f-nlu-net.trafficmanager.net, accounts.google.com, geo.prod.do.dsp.mp.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, dl.delivery.mp.microsoft.com-c.edgesuite.net, array616.prod.do.dsp.mp.microsoft.com, cp501.prod.do.dsp.mp.microsoft.com.edgekey.net, fe3cr.delivery.mp.microsoft.com, kv501.prod.do.dsp.mp.microsoft.com.edgekey.net, edgedl.me.gvt1.com, clients.l.google.com, tsfe.trafficshaping.dsp.mp.microsoft.com, a1683.dscd.akamai.net'
                              - Not all processes where analyzed, report is missing behavior information
                              - Report size getting too big, too many NtSetInformationFile calls found.
                          - analysis_id: ccd14e2b-47a6-4008-a39d-23d763adce9d
                            analysis_time: '2024-12-18T14:05:44'
                            classification: MALICIOUS
                            platform: windows11
                            configuration: MS Office 2016;Java 8;Adobe reader 21;Firefox 96;Google Chrome 113
                            risk_score: 9
                            classification_version: 3
                            browser: Google chrome 113
                            sample_name: ''
                            geolocation: us
                            locale: en-US
                            analysis_duration: 211
                            warnings:
                              - 'Max analysis timeout: 200s exceeded, the analysis took too long'
                              - 'Exclude process from analysis (whitelisted): SecurityHealthHost.exe, dllhost.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, svchost.exe'
                              - 'Excluded IPs from analysis (whitelisted): 13.71.55.58, 192.229.211.108, 199.232.214.172, 64.233.185.138, 64.233.185.101, 64.233.185.139, 64.233.185.102, 64.233.185.100, 64.233.185.113, 142.250.105.94, 64.233.177.84, 64.233.177.113, 64.233.177.101, 64.233.177.102, 64.233.177.100, 64.233.177.139, 64.233.177.138, 23.208.130.127, 23.219.162.89, 23.219.162.96'
                              - 'Excluded domains from analysis (whitelisted): geover.prod.do.dsp.mp.microsoft.com, dl.delivery.mp.microsoft.com, kv501.prod.do.dsp.mp.microsoft.com, slscr.update.microsoft.com, clientservices.googleapis.com, e10370.d.akamaiedge.net, cp501.prod.do.dsp.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, atm-settingsfe-prod-geo2.trafficmanager.net, redirector.gvt1.com, login.live.com, settings-prod-cin-2.centralindia.cloudapp.azure.com, geover.prod.do.dsp.mp.microsoft.com.edgekey.net, dl.delivery.mp.microsoft.com.delivery.microsoft.com, 1d.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, dcat-f-nlu-net.trafficmanager.net, geo.prod.do.dsp.mp.microsoft.com, accounts.google.com, 1D.tlu.dl.delivery.mp.microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, dl.delivery.mp.microsoft.com-c.edgesuite.net, cp501.prod.do.dsp.mp.microsoft.com.edgekey.net, fe3cr.delivery.mp.microsoft.com, dcat-b-tlu-net.trafficmanager.net, clients.l.google.com, tsfe.trafficshaping.dsp.mp.microsoft.com, a1683.dscd.akamai.net'
                              - Not all processes where analyzed, report is missing behavior information
                              - Report size getting too big, too many NtSetInformationFile calls found.
                        risk_score: 9
                        classification_version: 3
                        mitre_attack:
                          matrix_list:
                            - name: Enterprise
                              tactics:
                                tactic_list:
                                  - id: TA0002
                                    name: Execution
                                    techniques:
                                      technique_list:
                                        - id: T1106
                                          name: Native API
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  - id: TA0005
                                    name: Defense Evasion
                                    techniques:
                                      technique_list:
                                        - id: T1055
                                          name: Process Injection
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1036
                                          name: Masquerading
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1027.002
                                          name: Software Packing
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1070.004
                                          name: File Deletion
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  - id: TA0009
                                    name: Collection
                                    techniques:
                                      technique_list:
                                        - id: T1056
                                          name: Input Capture
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  - id: TA0007
                                    name: Discovery
                                    techniques:
                                      technique_list:
                                        - id: T1518.001
                                          name: Security Software Discovery
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1046
                                          name: Network Service Discovery
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  - id: TA0011
                                    name: Command and Control
                                    techniques:
                                      technique_list:
                                        - id: T1573
                                          name: Encrypted Channel
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1095
                                          name: Non-Application Layer Protocol
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                        - id: T1071
                                          name: Application Layer Protocol
                                          analysis_ids:
                                            - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                            - ccd14e2b-47a6-4008-a39d-23d763adce9d
                        dropped_files:
                          - md5: 29a37b6532a7acefa7580b826f23f6dd
                            sha1: a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
                            sha256: 7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
                            file_name: Unconfirmed 171614.crdownload (copy)
                            file_path: C:\Users\user\Downloads
                            sample_type: PE/Exe
                            sample_size: '32256'
                            classification: MALICIOUS
                            analysis_ids:
                              - classification: MALICIOUS
                                analysis_id: 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - md5: 29a37b6532a7acefa7580b826f23f6dd
                            sha1: a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
                            sha256: 7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
                            file_name: dc72bd61-dc74-48ee-bfcf-66d71ce8f73e.tmp
                            file_path: C:\Users\user\Downloads
                            sample_type: PE/Exe
                            sample_size: '32256'
                            classification: MALICIOUS
                            analysis_ids:
                              - classification: MALICIOUS
                                analysis_id: 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - md5: 29a37b6532a7acefa7580b826f23f6dd
                            sha1: a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
                            sha256: 7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
                            file_name: 'Chrome Cache Entry: 47'
                            file_path: ''
                            sample_type: PE/Exe
                            sample_size: '32256'
                            classification: MALICIOUS
                            analysis_ids:
                              - classification: MALICIOUS
                                analysis_id: 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - md5: 8bd295a9f9925ced3e2783b04d334a0f
                            sha1: 36370730ce0686e4da61249227ffc536dd816151
                            sha256: 6dd66c783c607c9996801b831032096c92b771f5e76ed139d729db008ce46929
                            file_name: 8ebab6a6-1a26-4854-98e2-9b285e1bb34a.tmp
                            file_path: C:\Users\user\Downloads
                            sample_type: PE/Exe
                            sample_size: '10663'
                            classification: NO_THREATS_FOUND
                            analysis_ids:
                              - classification: UNKNOWN
                                analysis_id: ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - md5: 29a37b6532a7acefa7580b826f23f6dd
                            sha1: a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
                            sha256: 7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
                            file_name: Unconfirmed 574299.crdownload
                            file_path: C:\Users\user\Downloads
                            sample_type: PE/Exe
                            sample_size: '32256'
                            classification: MALICIOUS
                            analysis_ids:
                              - classification: MALICIOUS
                                analysis_id: ccd14e2b-47a6-4008-a39d-23d763adce9d
                        behavioral:
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe"  --start-maximized  "about:blank"'
                              process_id: 7592
                              parent_process_id: 7436
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_time: '2024-12-18T06:01:02'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: BIZ-UDGOTHICR.TTC
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: YUMIN.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: MALGUN.TTF
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: MSYH.TTC
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SIMSUN.TTC
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\WINDOWS\FONTS
                                file_name: MSJH.TTC
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \pipe
                                file_name: mojo.7592.1192.9185543349772758213
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\resources\network_speech_synthesis\_metadata
                                file_name: computed_hashes.json
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object path not found
                              - file_path: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
                                file_name: Google Chrome.lnk
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows
                                file_name: SystemTemp
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\default_apps
                                file_name: external_extensions.json
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\WidevineCdm
                                file_name: manifest.json
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application\128.0.6613.114\PrivacySandboxAttestationsPreloaded
                                file_name: manifest.json
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: the-real-index
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 031224c8-09af-4617-a261-a2d7b0ceb37b.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 8a7316c5-8200-48bf-bb7d-75d76f94cd83.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 380472a1-0faf-4484-848f-f7118cc4cd80.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: b18863a2-b4d9-4992-90a1-2ee887c9bf1a.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                            registry_actions:
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
                                action_type: key_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
                                action_type: key_value_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name not found
                                value: ''
                                value_name: extensions.settings
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\FirstNotDefault
                                action_type: key_value_deleted
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: object name not found
                                value: ''
                                value_name: S-1-5-21-3573376691-1003541250-332242625-1001
                            process_actions:
                              - path: unknown
                                action_type: process_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                action_type: process_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - path: unknown
                                action_type: process_terminated
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: process is terminating
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2156,i,3080863878966395974,9710723346392385943,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11'
                              process_id: 5904
                              parent_process_id: 7592
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              process_time: '2024-12-18T06:01:04'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: \pipe
                                file_name: crashpad_7592_TTCNGSJHWJINVSTJ
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHCORE.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: kernel.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                            process_actions:
                              - path: unknown
                                action_type: process_created
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                action_type: process_terminated
                                analysis_ids:
                                  - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                status: success or wait
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe"  --start-maximized  "about:blank"'
                              process_id: 3800
                              parent_process_id: 3568
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_time: '2024-12-18T06:02:26'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \pipe
                                file_name: crashpad_3800_IZJXDIGCNNRLPQHX
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: netprofm.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: npmproxy.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: CryptoWinRT.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: cryptngc.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ncrypt.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: NTASN1.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: cd85ae04-dd68-41d0-8bdf-a9c819cf6d25.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
                                file_name: the-real-index
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
                                file_name: temp-index
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: the-real-index
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 11a5d007-d8cc-4433-aa78-015ed9047505.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 21418c5b-d72f-4e9d-8422-76a1545363fc.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 72069458-c828-4bad-8c4e-6251e7993555.tmp
                                action_type: file_moved
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                            registry_actions:
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
                                action_type: key_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                                value: ''
                                value_name: ''
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
                                action_type: key_value_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object name not found
                                value: ''
                                value_name: extensions.settings
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\FirstNotDefault
                                action_type: key_value_deleted
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: object name not found
                                value: ''
                                value_name: S-1-5-21-3573376691-1003541250-332242625-1001
                            process_actions:
                              - path: unknown
                                action_type: process_created
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                action_type: process_created
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - path: unknown
                                action_type: process_terminated
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: process is terminating
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2148,i,2195746873608610353,16668956073574200452,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11'
                              process_id: 3360
                              parent_process_id: 3800
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_time: '2024-12-18T06:02:29'
                            file_actions:
                              - file_path: C:\Windows\AppPatch
                                file_name: sysmain.sdb
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome\Application
                                file_name: chrome.exe
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\Globalization\Sorting
                                file_name: sortdefault.nls
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: NSI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: dhcpcsvc6.DLL
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: DNSAPI.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: nlansp_c.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: \Device
                                file_name: CNG
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Program Files\Google\Chrome
                                file_name: Application
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: sechost.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: RPCRT4.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ADVAPI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\system32
                                file_name: ntmarta.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: ucrtbase.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: msvcp_win.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: shcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: win32u.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: gdi32full.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: GDI32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: USER32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\System32
                                file_name: SHELL32.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - file_path: C:\Windows\SYSTEM32
                                file_name: kernel.appcore.dll
                                action_type: file_opened
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                            process_actions:
                              - path: unknown
                                action_type: process_created
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                              - path: C:\Program Files\Google\Chrome\Application\chrome.exe
                                action_type: process_terminated
                                analysis_ids:
                                  - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                status: success or wait
                        network:
                          dns:
                            - type: A (IP address)
                              value: fp2e7a.wpc.phicdn.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 192.229.211.108
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.48.36
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 217.20.55.38
                              process_id: 0
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 185.199.111.133
                              process_id: 5904
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 217.20.55.35
                              process_id: 0
                            - type: CNAME (Canonical name)
                              value: edge.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: none
                              process_id: 0
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.104
                              process_id: 5904
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 185.199.108.133
                              process_id: 5904
                            - type: A (IP address)
                              value: fg.microsoft.map.fastly.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 199.232.214.172
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 217.20.55.36
                              process_id: 0
                            - type: A (IP address)
                              value: default.qdr.p1.ds-c7109-microsoft.global.dns.qwilted-cds.cqloud.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 217.20.48.24
                              process_id: 0
                            - type: A (IP address)
                              value: fg.microsoft.map.fastly.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 199.232.210.172
                              process_id: 0
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.103
                              process_id: 5904
                            - type: A (IP address)
                              value: bg.microsoft.map.fastly.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 199.232.210.172
                              process_id: 0
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 185.199.110.133
                              process_id: 5904
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.99
                              process_id: 5904
                            - type: A (IP address)
                              value: bg.microsoft.map.fastly.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 199.232.214.172
                              process_id: 0
                            - type: CNAME (Canonical name)
                              value: fp2e7a.wpc.2be4.phicdn.net
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: none
                              process_id: 0
                            - type: A (IP address)
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: 108.177.122.147
                              process_id: 5904
                            - type: '65'
                              value: www.google.com
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              address: none
                              process_id: 5904
                            - type: A (IP address)
                              value: raw.githubusercontent.com
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              address: 185.199.108.133
                              process_id: 3360
                            - destination_port: 1900
                              destination_ip: 239.255.255.250
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 3800
                            - destination_port: 53
                              destination_ip: 8.8.4.4
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 0
                            - destination_port: 53
                              destination_ip: 8.8.8.8
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 3360
                            - destination_port: 53
                              destination_ip: 8.8.4.4
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              process_id: 3360
                        signatures:
                          - sig_id: 1649
                            description: Found graphical window changes (likely an installer)
                            risk_factor: 0
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 487
                            description: Malicious sample detected (through community YARA rule)
                            risk_factor: 10
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1472
                            description: Drops files with a non matching file extension (content does not match to file extension)
                            risk_factor: 7
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                          - sig_id: 361
                            description: YARA signature match
                            risk_factor: 7
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 1837
                            description: Contains functionality to log keystrokes (.Net Source)
                            risk_factor: 8
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                          - sig_id: 544
                            description: PE file overlay found
                            risk_factor: 7
                            analysis_ids:
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                        threat_names:
                          - threat_name: Njrat
                            analysis_ids:
                              - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              - ccd14e2b-47a6-4008-a39d-23d763adce9d
                        yara:
                          entries:
                            - source_type: dropped_file
                              source_name: C:\Users\user\Downloads\dc72bd61-dc74-48ee-bfcf-66d71ce8f73e.tmp
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              rule:
                                - description: Yara detected Njrat
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Detects NjRAT / Bladabindi
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27690
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: NjMgMDAgNkQgMDAgNjQgMDAgMkUgMDAgNjUgMDAgNzggMDAgNjUgMDAgMjAgMDAgMkYgMDAgNjMgMDAgMjAgMDAgNzAgMDAgNjkgMDAgNkUgMDAgNjc=
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: W2tsXQ==
                                      matched_offset: 27848
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: detect njRAT in memory
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbA==
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Windows_Trojan_Njrat_30f3c220
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: Z2V0X1JlZ2lzdHJ5
                                      matched_offset: 22375
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFtICI=
                                      matched_offset: 27690
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Detects malware from disclosed CN malware set
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: d2lubWdtdHM6XFwuXHJvb3RcU2VjdXJpdHlDZW50ZXIy
                                      matched_offset: 26716
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZWQgQXM=
                                      matched_offset: 27012
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U3R1Yi5leGU=
                                      matched_offset: 24499
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U2VsZWN0ICogRnJvbSBBbnRpVmlydXNQcm9kdWN0
                                      matched_offset: 26654
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Identify njRat
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: W1RBUF0=
                                      matched_offset: 27922
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5n
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                            - source_type: dropped_file
                              source_name: dropped/chromecache_47
                              analysis_ids:
                                - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                              rule:
                                - description: Yara detected Njrat
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Detects NjRAT / Bladabindi
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27690
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: NjMgMDAgNkQgMDAgNjQgMDAgMkUgMDAgNjUgMDAgNzggMDAgNjUgMDAgMjAgMDAgMkYgMDAgNjMgMDAgMjAgMDAgNzAgMDAgNjkgMDAgNkUgMDAgNjc=
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: W2tsXQ==
                                      matched_offset: 27848
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: detect njRAT in memory
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbA==
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Windows_Trojan_Njrat_30f3c220
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: Z2V0X1JlZ2lzdHJ5
                                      matched_offset: 22375
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFtICI=
                                      matched_offset: 27690
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Detects malware from disclosed CN malware set
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: d2lubWdtdHM6XFwuXHJvb3RcU2VjdXJpdHlDZW50ZXIy
                                      matched_offset: 26716
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RXhlY3V0ZWQgQXM=
                                      matched_offset: 27012
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U3R1Yi5leGU=
                                      matched_offset: 24499
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U2VsZWN0ICogRnJvbSBBbnRpVmlydXNQcm9kdWN0
                                      matched_offset: 26654
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                - description: Identify njRat
                                  analysis_ids:
                                    - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: W1RBUF0=
                                      matched_offset: 27922
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5n
                                      matched_offset: 27786
                                      analysis_ids:
                                        - 425978a3-fc10-42a4-8794-6e5a4f8aef63
                            - source_type: dropped_file
                              source_name: C:\Users\user\Downloads\Unconfirmed 574299.crdownload
                              analysis_ids:
                                - ccd14e2b-47a6-4008-a39d-23d763adce9d
                              rule:
                                - description: Yara detected Njrat
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: Detects NjRAT / Bladabindi
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27690
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: NjMgMDAgNkQgMDAgNjQgMDAgMkUgMDAgNjUgMDAgNzggMDAgNjUgMDAgMjAgMDAgMkYgMDAgNjMgMDAgMjAgMDAgNzAgMDAgNjkgMDAgNkUgMDAgNjc=
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: W2tsXQ==
                                      matched_offset: 27848
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: detect njRAT in memory
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 26942
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZSBFUlJPUg==
                                      matched_offset: 27038
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbA==
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: Windows_Trojan_Njrat_30f3c220
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: Z2V0X1JlZ2lzdHJ5
                                      matched_offset: 22375
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgZGVsZXRlIGFsbG93ZWRwcm9ncmFtICI=
                                      matched_offset: 27690
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: Detects malware from disclosed CN malware set
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCAi
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: d2lubWdtdHM6XFwuXHJvb3RcU2VjdXJpdHlDZW50ZXIy
                                      matched_offset: 26716
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RXhlY3V0ZWQgQXM=
                                      matched_offset: 27012
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: U3R1Yi5leGU=
                                      matched_offset: 24499
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: RG93bmxvYWQgRVJST1I=
                                      matched_offset: 26978
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: U2VsZWN0ICogRnJvbSBBbnRpVmlydXNQcm9kdWN0
                                      matched_offset: 26654
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                - description: Identify njRat
                                  analysis_ids:
                                    - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                  matched_data:
                                    - matched_string: bmV0c2ggZmlyZXdhbGwgYWRkIGFsbG93ZWRwcm9ncmFt
                                      matched_offset: 27522
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: U0VFX01BU0tfTk9aT05FQ0hFQ0tT
                                      matched_offset: 27474
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: W1RBUF0=
                                      matched_offset: 27922
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                                    - matched_string: Y21kLmV4ZSAvYyBwaW5n
                                      matched_offset: 27786
                                      analysis_ids:
                                        - ccd14e2b-47a6-4008-a39d-23d763adce9d
                        url: https://raw.githubusercontent.com/Zusyaku/Malware-Collection-Part-2/main/RAT/NJRat.exe
                        url_base64: aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL1p1c3lha3UvTWFsd2FyZS1Db2xsZWN0aW9uLVBhcnQtMi9tYWluL1JBVC9OSlJhdC5leGU
                        md5: ''
                        sha256: ''
                        sha1: f1e430ab96581ad37b2a24c03aece8b3a7059ae1
                      private_data_filtered: false
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - report
                      - requested_sha1_url
                      - private_data_filtered
                    properties:
                      report:
                        type: object
                        properties:
                          md5:
                            type: string
                            format: md5
                          sha1:
                            type: string
                            format: sha1
                          sha256:
                            type: string
                            format: sha256
                          url:
                            type: string
                            format: url
                          url_base64:
                            type: string
                            format: base64
                          risk_score:
                            type: number
                            minimum: 0
                            maximum: 10
                            description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                          classification:
                            type: string
                            description: The classification of the sample.
                            enum:
                              - MALICIOUS
                              - SUSPICIOUS
                              - KNOWN
                              - UNKNOWN
                          interactive:
                            type: string
                            description: |
                              Whether this report is the result of an interactive session
                              from Spectra Analyze.
                            enum:
                              - 'true'
                              - 'false'
                          timeout:
                            type: number
                            description: The maximum configured time the sample was allowed to run on the VM.
                          classification_version:
                            type: number
                          first_analysis:
                            type: string
                            format: date-time
                          last_analysis:
                            type: string
                            format: date-time
                          history_analysis:
                            type: array
                            description: An object containing an overview of all available reports.
                            items:
                              type: object
                              properties:
                                analysis_id:
                                  type: string
                                  description: The analysis ID of the report.
                                analysis_time:
                                  type: string
                                  description: The date and time of the analysis.
                                  format: date-time
                                classification:
                                  type: string
                                  description: The classification of the sample.
                                  enum:
                                    - MALICIOUS
                                    - SUSPICIOUS
                                    - KNOWN
                                    - UNKNOWN
                                platform:
                                  type: string
                                  description: The platform used to analyze the sample.
                                configuration:
                                  type: string
                                  description: A short description of the platform configuration specifics (for example, "Win10 x64, Office 2016, Java 8 Update 191").
                                optional_parameters:
                                  type: string
                                  enum:
                                    - internet_simulation=true
                                    - internet_simulation=false
                                  example: internet_simulation=false
                                risk_score:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                                  description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                                classification_version:
                                  type: number
                                browser:
                                  type: string
                                  description: Browser used in the sandbox.
                                sample_name:
                                  type: string
                                  description: Custom file name and/or extension provided on submission. Custom extensions impact which application was used to open and run the file.
                                geolocation:
                                  type: string
                                  description: Geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods.
                                  default: us
                                  enum:
                                    - us
                                    - uk
                                    - in
                                    - br
                                    - de
                                    - jp
                                    - sg
                                    - it
                                    - es
                                    - fr
                                    - tor
                                locale:
                                  type: string
                                  description: The configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes.
                                  default: en-US
                                  enum:
                                    - en-US
                                    - en-GB
                                    - pt-BR
                                    - de-DE
                                    - ja-JP
                                    - it-IT
                                    - es-ES
                                    - fr-FR
                                analysis_duration:
                                  type: number
                                  description: The duration of the analysis (in seconds).
                                warnings:
                                  type: array
                                  items:
                                    type: string
                                errors:
                                  type: array
                                  items:
                                    type: string
                                pcap:
                                  type: string
                                  format: url
                                memory_strings:
                                  type: string
                                  format: url
                                screenshots:
                                  type: string
                                  format: url
                                dropped_files:
                                  type: string
                                  format: url
                          platforms:
                            type: array
                            description: Platforms used to analyze the sample.
                            items:
                              type: string
                              enum:
                                - windows7
                                - windows10
                                - macos11
                          behavioral:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                          signatures:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                                sig_id:
                                  type: string
                                description:
                                  type: string
                                risk_factor:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                              required:
                                - analysis_ids
                          threat_names:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                                threat_name:
                                  type: string
                              required:
                                - analysis_ids
                          yara:
                            type: object
                            properties:
                              entries:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    analysis_ids:
                                      type: array
                                      items:
                                        type: string
                                        format: uuid
                                  required:
                                    - analysis_ids
                          suricata_alerts:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                              required:
                                - analysis_ids
                          bot_configurations:
                            type: array
                            items:
                              type: object
                              properties:
                                analysis_ids:
                                  type: array
                                  items:
                                    type: string
                                    format: uuid
                              required:
                                - analysis_ids
                      requested_sha1_url:
                        type: string
                        format: sha1
                      private_data_filtered:
                        $ref: '#/components/schemas/private_data_filtered'
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/url/sha1/171ba7127cf28cc63ea1fef74be9746842f5093f' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/url/sha1/171ba7127cf28cc63ea1fef74be9746842f5093f"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/dynamic/analysis/report/v1/query/url/sha1/{sha1_value}/{specific_report}:
    get:
      summary: 'TCA-0106: URL Dynamic Analysis Report (SHA1) (specific report)'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: get-api-dynamic-analysis-report-v1-query-url-sha1-sha1_value-specific_report
      parameters:
        - name: sha1_value
          in: path
          required: true
          schema:
            type: string
          description: Required parameter. This parameter expects a SHA1 hash value to generate a report of the analyzed URLs.
        - name: specific_report
          in: path
          required: true
          schema:
            oneOf:
              - type: string
                enum:
                  - latest
                description: '`latest`: incompatible and mutually exclusive with `analysis_id`.'
              - type: string
                description: '`analysis_id`: incompatible and mutually exclusive with `latest`.'
          description: If added at the end of the request, the response will contain either the latest dynamic analysis report, or the report matching the provided analysis_id. These two parameters are mutually exclusive.
      description: The URL Dynamic Analysis Report (SHA1) service allows users to retrieve dynamic analysis reports for URLs executed in the cloud sandbox. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_sha1_url: 171ba7127cf28cc63ea1fef74be9746842f5093f
                      report:
                        analysis_id: 153bfc12-1eb7-411e-aa77-55f6106583f9
                        md5: ''
                        sha1: 171ba7127cf28cc63ea1fef74be9746842f5093f
                        sha256: ''
                        url: http://9779.info/
                        url_base64: aHR0cDovLzk3NzkuaW5mby8
                        analysis_time: '2024-01-05T11:45:56'
                        classification: SUSPICIOUS
                        risk_score: 6
                        platform: windows10
                        configuration: MS Office 2007;Java 8;Adobe Reader 2020;Firefox 62;Google Chrome 69;Microsoft Edge 42;Internet Explorer 11
                        process_tree:
                          - name: chrome.exe
                            parameters: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"  --start-maximized  "about:blank
                            process_id: 2560
                            parent_process_id: 3408
                          - name: chrome.exe
                            parameters: '"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1684,i,1333519164900971791,4046633923457182207,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8'
                            process_id: 6772
                            parent_process_id: 2560
                          - name: chrome.exe
                            parameters: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "http://9779.info/
                            process_id: 4444
                            parent_process_id: 3408
                        analysis_duration: 169
                        warnings:
                          - 'Exclude process from analysis (whitelisted): MpCmdRun.exe, conhost.exe'
                          - 'Excluded IPs from analysis (whitelisted): 172.217.18.3, 34.104.35.123, 142.250.186.66, 216.58.206.42, 142.250.185.67, 142.250.184.226, 142.250.186.99'
                          - 'Excluded domains from analysis (whitelisted): www.googleadservices.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, fonts.gstatic.com, partner.googleadservices.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com'
                          - Not all processes where analyzed, report is missing behavior information
                          - Report size getting too big, too many NtWriteVirtualMemory calls found.
                        threat_names:
                          - threat_name: Unknown
                        dropped_files:
                          - md5: 69d35d2d6ca6e439fb0ad07326dc8a33
                            sha1: b866c8cc87b260d9a5aa15d1171d98aa741de00d
                            sha256: 40e3bbb6039d1c98fa8757fe385465d834848f189c01ade7f74af9873a3082fa
                            file_name: 'Chrome Cache Entry: 164'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '1075'
                            classification: NO_THREATS_FOUND
                          - md5: 01ffd8a1307329a28ba1eda08e0bb9b0
                            sha1: 848e7d79321def94e4a2215a2b43d797959f7a01
                            sha256: d079038accbb890a90fd39cdd73be2196e35d1aef615d344e07237dfcb8c6eda
                            file_name: 'Chrome Cache Entry: 161'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '174'
                            classification: NO_THREATS_FOUND
                          - md5: 7fcc0c01d76f0469b65ab12a82a3a2cd
                            sha1: cc903316de3324c832a09df4b01637f722a12fa2
                            sha256: 68755229e2f2bce7c04519d532991cf27b372359aa1bfaae641e98f1213b78b8
                            file_name: 'Chrome Cache Entry: 190'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '19820'
                            classification: NO_THREATS_FOUND
                          - md5: 1867771add1d5dbb17bd1ab7469c7fff
                            sha1: 8dfb8d9245d4abbd0174b28d66422b2e211a6329
                            sha256: 8343010321a203aa9285287d0d107b0255efad786f6bc2e4d675652efd828633
                            file_name: 'Chrome Cache Entry: 132'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '4210'
                            classification: NO_THREATS_FOUND
                          - md5: bc3ba461c8a309acf61b6d9c41cb6236
                            sha1: 88482306ecc9258d5e9cbb9ba5314dab223a5db4
                            sha256: 31331f1b1519882d2f2fb60367708fd56a7a1ec0bddd0554c635547179c7dc8f
                            file_name: 'Chrome Cache Entry: 153'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '655'
                            classification: NO_THREATS_FOUND
                          - md5: 36eba86075a759bc37a25c2e842ebd31
                            sha1: 20ca2d556b4ed88dcd899ff817393deb49eee9e0
                            sha256: a0e6977c7b3d49f1c34882915d14ffb7f282510753c6ca662db4cfdd53b792ff
                            file_name: 'Chrome Cache Entry: 166'
                            file_path: ''
                            sample_type: Text/None
                            sample_size: '46'
                            classification: NO_THREATS_FOUND
                          - md5: 24b17f233ae02c1d770de21aec38d7b9
                            sha1: 59578ba58a40c44ec20fd04b75fef080e81e0c42
                            sha256: b332be652cff2434c53b1c0402acfaead88178d62d34aef75543a90a04a87877
                            file_name: 'Chrome Cache Entry: 191'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '22930'
                            classification: NO_THREATS_FOUND
                          - md5: cf81f7bd280cd7cbee6b4dfab2cfe73c
                            sha1: d2f74016f17f3784d6c3dc2a9c63791b7148a519
                            sha256: 01d605ba7a0ec0911356ba953f75f1c9585eca77240280afae4da444507ffd84
                            file_name: 'Chrome Cache Entry: 128'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '1123'
                            classification: NO_THREATS_FOUND
                          - md5: 232b19913357b4c657c182aeab853992
                            sha1: f9d42ec577fad344a249637bb0afdf7f1f9d9171
                            sha256: 270838ac3c0e56430d40e9ba072a11c7212b45583840cf3b938c111d9748b98a
                            file_name: 'Chrome Cache Entry: 192'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '42237'
                            classification: NO_THREATS_FOUND
                          - md5: 77dcd29bceef4666f04454293eb2199b
                            sha1: cc01089f0fecefa774bd706abec1b4929f551a7f
                            sha256: bc2f1a1f1d53391cc12d71973cc3660bf59ecf68b79bb11d443bf8e4441b986e
                            file_name: 'Chrome Cache Entry: 148'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '240'
                            classification: NO_THREATS_FOUND
                          - md5: 8bb4ba711047411893d35612bc631ab9
                            sha1: fddc00eca2e66e4431c9615df508a1a377adce42
                            sha256: 4bce5252202292e4d9d6de37a5bd004cb52d8c44e9f940bbcdd030ea569f29dc
                            file_name: 'Chrome Cache Entry: 102'
                            file_path: ''
                            sample_type: Image/None/WOFF
                            sample_size: '27332'
                            classification: NO_THREATS_FOUND
                          - md5: 107694ee1e94990d97b7e58651ffd6a0
                            sha1: 7dd9ae7badf78be01ea0623df1e90171348716ff
                            sha256: 7aa2a3e9a9575a27f5593c3b0357423128c468a46ed20d284ce5a21555ee67bc
                            file_name: 'Chrome Cache Entry: 150'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '13502'
                            classification: NO_THREATS_FOUND
                          - md5: 32cfd23230827bef1172107322ebf1c2
                            sha1: de9cfa7ceed8645c5ca88cb2fdec046f284a64e4
                            sha256: 358d1c6d7fbebb7831034b12a71814b074ce18955cbe9720eb59e59aff2475fb
                            file_name: 'Chrome Cache Entry: 183'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '10587'
                            classification: NO_THREATS_FOUND
                          - md5: 9028b744b5c6619bceebaebeb7fe699c
                            sha1: daa0d31567bb825e0391acb81d0978cab0ae468a
                            sha256: 31627e4cbee3e4459d55520440f59c8b7ee5103d390501f4e3351e6fd492dd7e
                            file_name: 'Chrome Cache Entry: 127'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '27512'
                            classification: NO_THREATS_FOUND
                          - md5: 32cfd23230827bef1172107322ebf1c2
                            sha1: de9cfa7ceed8645c5ca88cb2fdec046f284a64e4
                            sha256: 358d1c6d7fbebb7831034b12a71814b074ce18955cbe9720eb59e59aff2475fb
                            file_name: 'Chrome Cache Entry: 96'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '10587'
                            classification: NO_THREATS_FOUND
                          - md5: 01ffd8a1307329a28ba1eda08e0bb9b0
                            sha1: 848e7d79321def94e4a2215a2b43d797959f7a01
                            sha256: d079038accbb890a90fd39cdd73be2196e35d1aef615d344e07237dfcb8c6eda
                            file_name: 'Chrome Cache Entry: 158'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '174'
                            classification: NO_THREATS_FOUND
                          - md5: 7befe912c15dd700f6e5ae5756f31887
                            sha1: 616ba3e59e615d5933c9707e7f05339e20a83b06
                            sha256: 397bcd31b0fdcbf43bd89b1dfabb16a4ab4e16484cd39321ea3d166fa01e82d7
                            file_name: 'Chrome Cache Entry: 100'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '54301'
                            classification: NO_THREATS_FOUND
                          - md5: 94519566b55451f383266ff6920d7bba
                            sha1: 4a5bdff9371ba1dd663d68dd156c185757d89333
                            sha256: a3ca3fd3da382f56689d79f15a2471fa7f76f9a41cba5a361649c8ece007045e
                            file_name: 'Chrome Cache Entry: 101'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '49578'
                            classification: NO_THREATS_FOUND
                          - md5: 7f7a2254032e4016342665f34615163c
                            sha1: 366e656e0f36d47f0a9810446c6df3ed530f6284
                            sha256: 980f9520e45fa409320025cb10a3e7f8bd52f948e9f53ca5e46059433a2db97b
                            file_name: 'Chrome Cache Entry: 159'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '318'
                            classification: NO_THREATS_FOUND
                          - md5: 83f4bbe233a471c6b1ca01c38486ad1b
                            sha1: 43632f69667a4bdafa7c4232e91d2674396e340b
                            sha256: 9b3deb5f2812415be09ce8ade7db608546fd4d9c9900f3576fa00a2291f8dbe3
                            file_name: 'Chrome Cache Entry: 106'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '370'
                            classification: NO_THREATS_FOUND
                          - md5: f4eaec7d37a188e85bd17b768063e79f
                            sha1: db2aa625f1d6723231c73e1005b31d4c66bc8369
                            sha256: eca5ff41047cc5240deb3a80fc1cde3f276fa71af11c30273e7b2a6899e9dbdb
                            file_name: 'Chrome Cache Entry: 144'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '2062'
                            classification: NO_THREATS_FOUND
                          - md5: 36eba86075a759bc37a25c2e842ebd31
                            sha1: 20ca2d556b4ed88dcd899ff817393deb49eee9e0
                            sha256: a0e6977c7b3d49f1c34882915d14ffb7f282510753c6ca662db4cfdd53b792ff
                            file_name: 'Chrome Cache Entry: 135'
                            file_path: ''
                            sample_type: Text/None
                            sample_size: '46'
                            classification: NO_THREATS_FOUND
                          - md5: 232b19913357b4c657c182aeab853992
                            sha1: f9d42ec577fad344a249637bb0afdf7f1f9d9171
                            sha256: 270838ac3c0e56430d40e9ba072a11c7212b45583840cf3b938c111d9748b98a
                            file_name: 'Chrome Cache Entry: 181'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '42237'
                            classification: NO_THREATS_FOUND
                          - md5: 15864ce88fa79a3e954417d0c3396798
                            sha1: fb9c3441942954b8ef8d637cdb307cbbae25da56
                            sha256: 97fde46829e88416162d1cf2ba9c0bdc0a5c45d826ecf44095782afd7417c500
                            file_name: 'Chrome Cache Entry: 163'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '6759'
                            classification: NO_THREATS_FOUND
                          - md5: 00e18964fba583769dcc97245b06cbc0
                            sha1: 145b37095e53ad8cba15c162b25bde9830cc0890
                            sha256: b4fd007408fcf22b7b71a61b3ebac2379f9ce2f3a5d9ef694684f12024fbc9a9
                            file_name: 'Chrome Cache Entry: 186'
                            file_path: ''
                            sample_type: Image/None/WOFF
                            sample_size: '10672'
                            classification: NO_THREATS_FOUND
                          - md5: 45c55f274d79a72f85a34326e126ed25
                            sha1: ab5e70c1ca4b722c30ce1dea40092c4f8318b4e3
                            sha256: 4d515874b2f0f8d673d3a33b8a1558d125db26be618aa9e3a6f81f51e0601121
                            file_name: 'Chrome Cache Entry: 169'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '30665'
                            classification: NO_THREATS_FOUND
                          - md5: 3a959aa26b73f4c331d34c091ab29a33
                            sha1: 26e5ccca241ab272b944a0fc368246e2dc05d4d0
                            sha256: 87d8ef111c439a450a1b6671e6490e0a382a4ea079e2cbdf6e71807355ae0219
                            file_name: 'Chrome Cache Entry: 120'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '11816'
                            classification: NO_THREATS_FOUND
                          - md5: 4da06cef70a86e23233ce53653203430
                            sha1: 58fd762da80017a903d221f1f08a93c65c4af85b
                            sha256: e1c51fa178072bb4dd83c94a67a08429440afa3726a717e3f836d9ccd66ee371
                            file_name: 'Chrome Cache Entry: 155'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '2561'
                            classification: NO_THREATS_FOUND
                          - md5: 2258a6a9551c8713106806b00205d58a
                            sha1: 3c6610fc792568b65a758132b84a64016905018b
                            sha256: dbbcccf4bb8fff79866df588d37ebeb3810093983c700d829e0e2dc94a862976
                            file_name: 'Chrome Cache Entry: 122'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '54294'
                            classification: NO_THREATS_FOUND
                          - md5: 7275c99f02a6cc2912ae87228d581772
                            sha1: 4ec9f9376fb1a2f8edc1596ccb59581c77e9ad16
                            sha256: 81b02184548e9612784b5d4a4f77432434dafd42bba70453a4941bdfb08362bb
                            file_name: 'Chrome Cache Entry: 156'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '54841'
                            classification: NO_THREATS_FOUND
                          - md5: 7fcc0c01d76f0469b65ab12a82a3a2cd
                            sha1: cc903316de3324c832a09df4b01637f722a12fa2
                            sha256: 68755229e2f2bce7c04519d532991cf27b372359aa1bfaae641e98f1213b78b8
                            file_name: 'Chrome Cache Entry: 123'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '19820'
                            classification: NO_THREATS_FOUND
                          - md5: 15a6ced0553472e6649ec87a6ae57fa9
                            sha1: 95d841709ba3518b75f99079c7f955f18018e8c8
                            sha256: 8877a9541625dd8b57bdbc0569e8eacd928acb992e3a89bb7050fe8826842d04
                            file_name: 'Chrome Cache Entry: 168'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '7633'
                            classification: NO_THREATS_FOUND
                          - md5: 8bb4ba711047411893d35612bc631ab9
                            sha1: fddc00eca2e66e4431c9615df508a1a377adce42
                            sha256: 4bce5252202292e4d9d6de37a5bd004cb52d8c44e9f940bbcdd030ea569f29dc
                            file_name: 'Chrome Cache Entry: 178'
                            file_path: ''
                            sample_type: Image/None/WOFF
                            sample_size: '27332'
                            classification: NO_THREATS_FOUND
                          - md5: 70e0fb1fbb3a5cd39a9921097080baaf
                            sha1: ae86845945f08fde14034c364f61367395552f7c
                            sha256: 4024da2ec0ae0a33ea64702a3be2463565fc007dfefa366c2f607585c1edff29
                            file_name: 'Chrome Cache Entry: 116'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '105309'
                            classification: NO_THREATS_FOUND
                          - md5: 36eba86075a759bc37a25c2e842ebd31
                            sha1: 20ca2d556b4ed88dcd899ff817393deb49eee9e0
                            sha256: a0e6977c7b3d49f1c34882915d14ffb7f282510753c6ca662db4cfdd53b792ff
                            file_name: 'Chrome Cache Entry: 133'
                            file_path: ''
                            sample_type: Text/None
                            sample_size: '46'
                            classification: NO_THREATS_FOUND
                          - md5: f99a27fd6aaba67fb4b3b9e06924878d
                            sha1: f6a7bc59818b2086dbf0241ac82043d869abe311
                            sha256: 3b3dfb5ce0dab485ff793084d7aaffb1c6e577d5c3bd13b26f3efe543e79ef5b
                            file_name: 'Chrome Cache Entry: 97'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '8102'
                            classification: NO_THREATS_FOUND
                          - md5: 94ea493fab119735d7ce96fd64133b03
                            sha1: 3e1ee94a2472dc6f5d7cc4b3a70d517b103a85fa
                            sha256: 8351aae2609db4f1e4b9d65696a3d8fcb75957aee0ae03b0db43d1b35db7a6b1
                            file_name: 'Chrome Cache Entry: 121'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '2882'
                            classification: NO_THREATS_FOUND
                          - md5: ab28995459e9c339fb6ab7cff0df47d8
                            sha1: 68d8cc1ea52164dc3bf01ec90c6fdd76478328bd
                            sha256: 6d7558ea80a14e69c98d0b6f135b2ded0ccd66768a1d6f6603e923d589a9de16
                            file_name: 'Chrome Cache Entry: 105'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '1694'
                            classification: NO_THREATS_FOUND
                          - md5: 00bfa19cecc3900646c108e4ac706488
                            sha1: c53d45529667d136551d190b3d0433c10317f6da
                            sha256: adbbb1570f134e34309f6335b650f8704232d270f25624283a8b56ea48236e57
                            file_name: 'Chrome Cache Entry: 107'
                            file_path: ''
                            sample_type: Image/None/WOFF
                            sample_size: '11400'
                            classification: NO_THREATS_FOUND
                          - md5: b28ff28fe33cbca107f9e420215cb5f0
                            sha1: dc7a84224cd58bf285025d3c10f4e4d6763c03dc
                            sha256: 04e0f791d7efd9ebf5d6a3054edd81e156fc7a31f8757fbb2472e488c1e82021
                            file_name: 'Chrome Cache Entry: 145'
                            file_path: ''
                            sample_type: Text/None
                            sample_size: '1018'
                            classification: NO_THREATS_FOUND
                          - md5: 975b45bc2e8ae9ab1259d60c06d35e84
                            sha1: 240cbf0faf26fd8424f0ad59d82eb19199ca5409
                            sha256: 74ce114211f59f69a61e8934a89b243d2d30eb1ec0406132148ae51bafc6333a
                            file_name: 'Chrome Cache Entry: 126'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '3602'
                            classification: NO_THREATS_FOUND
                          - md5: ec11193145a154682132d6f1d3b5b865
                            sha1: f024030a4fff4de5e63051f0481f05533973ba37
                            sha256: 0c601c4935313762900ed00dc1bff531442e3b7c6c94874979507462880cae45
                            file_name: 'Chrome Cache Entry: 160'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '3646'
                            classification: NO_THREATS_FOUND
                          - md5: 34728207d8866591537b004617ebc934
                            sha1: c2349d2da5e93b32b8b37de746b895d4355da876
                            sha256: 417e432a47f7df09b95a50dd64ea392f008f3a3fe64389234d221fb59ef14f20
                            file_name: 'Chrome Cache Entry: 185'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '36978'
                            classification: NO_THREATS_FOUND
                          - md5: 29e926bdba6500f71a5496a3b470607a
                            sha1: b5a4c71dd96733df7da183c5eec3c9e144666391
                            sha256: 985a3f2726dd0758d0f5444fd1c561ff4c3482445bfb64a601e06f9ae67bde6d
                            file_name: 'Chrome Cache Entry: 151'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '50540'
                            classification: NO_THREATS_FOUND
                          - md5: 32cfd23230827bef1172107322ebf1c2
                            sha1: de9cfa7ceed8645c5ca88cb2fdec046f284a64e4
                            sha256: 358d1c6d7fbebb7831034b12a71814b074ce18955cbe9720eb59e59aff2475fb
                            file_name: 'Chrome Cache Entry: 111'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '10587'
                            classification: NO_THREATS_FOUND
                          - md5: 4aa22f43cf5b185d5ad648417336930a
                            sha1: 8ec35252e56a7e9b33677dafffb01a4882a1c265
                            sha256: 2e923ddab2b03b422400b4bc50509d96965e2b771d6e2c0e69a83de2a61076cf
                            file_name: 'Chrome Cache Entry: 140'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '272'
                            classification: NO_THREATS_FOUND
                          - md5: 9246cca8fc3c00f50035f28e9f6b7f7d
                            sha1: 3aa538440f70873b574f40cd793060f53ec17a5d
                            sha256: c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
                            file_name: 'Chrome Cache Entry: 182'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '61'
                            classification: NO_THREATS_FOUND
                          - md5: e1ed7bfaf52cd2f0b5f946daec6cd4ab
                            sha1: 98284e9cedc7e934c937dd177616995cfa189c3d
                            sha256: c4a811ae8c20112663aa2e6b4c7f4be3f386679448f70631d1815612b9765655
                            file_name: 'Chrome Cache Entry: 113'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '48569'
                            classification: NO_THREATS_FOUND
                          - md5: 55b13a8702fdacc18ea7074c71cd10a6
                            sha1: 8dc379890ac95a3dd53d019e9f161faaa6aa0bca
                            sha256: c3c27204886383ccdb12e107c3d6a21ec0f516c21a9d745467eaa8d0885beb2f
                            file_name: 'Chrome Cache Entry: 119'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '616'
                            classification: NO_THREATS_FOUND
                          - md5: f65d136f378cd22eed47c416d1d8097e
                            sha1: f59c9c299939e28f77b1fcd42df7609fc6c529cb
                            sha256: da5fe47c053d2ddf43b3d159330c30276f942e26934da65242d449644414358e
                            file_name: 'Chrome Cache Entry: 179'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '52602'
                            classification: NO_THREATS_FOUND
                          - md5: 95ce0c20696063dadfc8cf1dc44cdf47
                            sha1: a2291d9420333ad7c3b7c33845bbe8514643e551
                            sha256: 7cbf779c4fcee8dbaf068d5c36f90a21b276ba7feaf9b91a214007e0583993bd
                            file_name: 'Chrome Cache Entry: 125'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '2565'
                            classification: NO_THREATS_FOUND
                          - md5: 3d054eecf556c1878bee9e30149c27e6
                            sha1: c905873d419c0c977ea54864f4eddd68769bdcf2
                            sha256: 5ae1952ba003705e8b39cd7978543f797519ad14d72ce858a5f0e996af2c5186
                            file_name: 'Chrome Cache Entry: 108'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '2360'
                            classification: NO_THREATS_FOUND
                          - md5: 1867771add1d5dbb17bd1ab7469c7fff
                            sha1: 8dfb8d9245d4abbd0174b28d66422b2e211a6329
                            sha256: 8343010321a203aa9285287d0d107b0255efad786f6bc2e4d675652efd828633
                            file_name: 'Chrome Cache Entry: 177'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '4210'
                            classification: NO_THREATS_FOUND
                          - md5: 076a916304f1e046b99fda08663289b6
                            sha1: 3d2c97a31a14891f18e0f3176ea59bdb77075b2b
                            sha256: 94256f016d63452093ef4b8dc65cd43b2817de64daae6477135bd11ecd8da821
                            file_name: 'Chrome Cache Entry: 154'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '12367'
                            classification: NO_THREATS_FOUND
                          - md5: cc403e7b83917d2b773e4ee1bafcf7a0
                            sha1: ca3e78337a3bb73f743d406fe40a5cff3119935e
                            sha256: 38d8f8bc96a85d4e70bf0e4aeac239b3c1e0afc02d92bd5345d7f37b9618304a
                            file_name: 'Chrome Cache Entry: 124'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '3586'
                            classification: NO_THREATS_FOUND
                          - md5: 165e65db3dee6be25b33f8ea14be5fb3
                            sha1: 50d1e0180c65eabeb4e89807db132bffcbdd1061
                            sha256: be26c396631e182dd031579cd198a3d4d847b982ff4d929068f272f0950fc2d2
                            file_name: 'Chrome Cache Entry: 189'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '968'
                            classification: NO_THREATS_FOUND
                          - md5: e700e576937192ab6b6b0848a16cb638
                            sha1: e29e232590863d7a06c842ab64e8d4873c487f50
                            sha256: 2dbe667fa21ea5bddcde4180fb419fa9c14ee43697799f1d459f33973d4d4637
                            file_name: 'Chrome Cache Entry: 188'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '3508'
                            classification: NO_THREATS_FOUND
                          - md5: b125dc28311a0c2bbe52c81e2b448dd6
                            sha1: 571e1cccdc8514618ad14d2822c2b9d39ad50b75
                            sha256: 678f9d972efd3371793e158ba103863f55b38a40a89067cd9d476717a4e86801
                            file_name: 'Chrome Cache Entry: 172'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '68061'
                            classification: NO_THREATS_FOUND
                          - md5: 9246cca8fc3c00f50035f28e9f6b7f7d
                            sha1: 3aa538440f70873b574f40cd793060f53ec17a5d
                            sha256: c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
                            file_name: 'Chrome Cache Entry: 184'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '61'
                            classification: NO_THREATS_FOUND
                          - md5: 29e926bdba6500f71a5496a3b470607a
                            sha1: b5a4c71dd96733df7da183c5eec3c9e144666391
                            sha256: 985a3f2726dd0758d0f5444fd1c561ff4c3482445bfb64a601e06f9ae67bde6d
                            file_name: 'Chrome Cache Entry: 149'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '50540'
                            classification: NO_THREATS_FOUND
                          - md5: 83f4bbe233a471c6b1ca01c38486ad1b
                            sha1: 43632f69667a4bdafa7c4232e91d2674396e340b
                            sha256: 9b3deb5f2812415be09ce8ade7db608546fd4d9c9900f3576fa00a2291f8dbe3
                            file_name: 'Chrome Cache Entry: 157'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '370'
                            classification: NO_THREATS_FOUND
                          - md5: 00b6a6e92620d4064ea52f7d0c850515
                            sha1: 1211958c23713a1b09e1daa67197f4f4e47bdd55
                            sha256: 85328ab0cad0eeb38bbff8d01d780c4f35c844309338894bb8ffabc171f87de9
                            file_name: 'Chrome Cache Entry: 165'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '686'
                            classification: NO_THREATS_FOUND
                          - md5: 5b66a3d2a8973a29d8d192db0a46080b
                            sha1: ff72cf3c5fe0192b10089b599502ab3fabbf0023
                            sha256: 7bc33ceb36096d0de05681b3d455cad366588a8e5117b36ef8f4061f47e39425
                            file_name: 'Chrome Cache Entry: 112'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '522'
                            classification: NO_THREATS_FOUND
                          - md5: 36eba86075a759bc37a25c2e842ebd31
                            sha1: 20ca2d556b4ed88dcd899ff817393deb49eee9e0
                            sha256: a0e6977c7b3d49f1c34882915d14ffb7f282510753c6ca662db4cfdd53b792ff
                            file_name: 'Chrome Cache Entry: 174'
                            file_path: ''
                            sample_type: Text/None
                            sample_size: '46'
                            classification: NO_THREATS_FOUND
                          - md5: 19f84c0804de34ad11402c1922780645
                            sha1: 7e67ef79c314c8743ba51470a279ff6e880b6446
                            sha256: e699a0cf9834c188ccdbc5fc98b122209b23dabe5f0ef6806c2db93115387575
                            file_name: 'Chrome Cache Entry: 103'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '186'
                            classification: NO_THREATS_FOUND
                          - md5: 2fe3d5fbcb0d85c72d064fc69d6414fa
                            sha1: cdb5f75e5341fefd368f11fec82d43f941da518c
                            sha256: 0ac600398c7ff1a29828a0a0c2c77bba481740d8a041bb748d478729166be975
                            file_name: 'Chrome Cache Entry: 138'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '47523'
                            classification: NO_THREATS_FOUND
                          - md5: 9fa2f809c184b1f61b213cd4e503a226
                            sha1: 5d7a209eb9da1e823ea6bdc9610005d7a224b35f
                            sha256: f47ef292aa20330e7c78dc476c33845afbc76cb0ba0901bc1f29492cfeb28437
                            file_name: 'Chrome Cache Entry: 143'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '2624'
                            classification: NO_THREATS_FOUND
                          - md5: 7f5c84fa316cb63e2600d2c603816f08
                            sha1: 0cf802fe0feabc0afe51480ed88f1c439d026721
                            sha256: d7fd556c8919641a06fec3e91e18a0a6be63492d8b2ce74692247b3566e29c87
                            file_name: 'Chrome Cache Entry: 118'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '808'
                            classification: NO_THREATS_FOUND
                          - md5: 6a29ceea62ee30681a88c99e176cea3f
                            sha1: ea9b3115b49490157e6f89d0fb512a6aeef8ba0e
                            sha256: 35405aa67bae0c10b57cbc21f1f4be3f11e44eeafc3ed2c4f59004b1081eccc0
                            file_name: 'Chrome Cache Entry: 187'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '54301'
                            classification: NO_THREATS_FOUND
                          - md5: 3702ada73b8951017b8451cbd6a96523
                            sha1: fba130b6f83751655f96df7f947b9591da67c50b
                            sha256: a714def57c786512c5f2ba2cc4dfa9efe919cd5f2004d05378d5be2377f627ef
                            file_name: 'Chrome Cache Entry: 98'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '522'
                            classification: NO_THREATS_FOUND
                          - md5: c4fc2a699f5911c8a76801f9cc0e6041
                            sha1: 234fb5423fa474a9ad4e6400aa0bfd234bccd17d
                            sha256: f3de437b6f851aca580c747f36504e7267c60a6909dd365096b8a19c7bc2b6ce
                            file_name: 'Chrome Cache Entry: 104'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '192363'
                            classification: NO_THREATS_FOUND
                          - md5: d411a58eee994203cfb4d647cf009036
                            sha1: 12ce16db61af69c6628e45b40412e604cad2e732
                            sha256: 37615f758e77462b1961c4633bf68d233c4ec8dac37d1e3fbca00d1bf93cdf0e
                            file_name: 'Chrome Cache Entry: 162'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '61'
                            classification: NO_THREATS_FOUND
                          - md5: def00c11b1596db4efee6a9fbe64fc27
                            sha1: bd298981e6d8d7e4ffa18abcf687041f4246672d
                            sha256: 95c427fa3143b1896faf42a6406686ce7602cb39052081bb32d12b51c9e047e4
                            file_name: 'Chrome Cache Entry: 141'
                            file_path: ''
                            sample_type: Image/None/ICO
                            sample_size: '15086'
                            classification: NO_THREATS_FOUND
                          - md5: 53e9d0acb7f06dbc3f3d387b17e7acee
                            sha1: ec8a9af916dc3ac86f37942c4bdfbaea100b041f
                            sha256: f3aa6d81c79299f9c05cc6453d4299c1a03198b19858a62b0765eef809ce23e5
                            file_name: 'Chrome Cache Entry: 114'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '5284'
                            classification: NO_THREATS_FOUND
                          - md5: b125dc28311a0c2bbe52c81e2b448dd6
                            sha1: 571e1cccdc8514618ad14d2822c2b9d39ad50b75
                            sha256: 678f9d972efd3371793e158ba103863f55b38a40a89067cd9d476717a4e86801
                            file_name: 'Chrome Cache Entry: 136'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '68061'
                            classification: NO_THREATS_FOUND
                          - md5: e80eefb2e693f982ade7d2f9c41c59ea
                            sha1: f240d480114e47abe991d4a9c3ec1a3b95b1e0f0
                            sha256: 115ea8ccc77135e889658e3922a3ce4747db8cd8a9ffc82286d4b48c771c4da0
                            file_name: 'Chrome Cache Entry: 129'
                            file_path: ''
                            sample_type: Image/None/WOFF
                            sample_size: '11256'
                            classification: NO_THREATS_FOUND
                          - md5: 3702ada73b8951017b8451cbd6a96523
                            sha1: fba130b6f83751655f96df7f947b9591da67c50b
                            sha256: a714def57c786512c5f2ba2cc4dfa9efe919cd5f2004d05378d5be2377f627ef
                            file_name: 'Chrome Cache Entry: 99'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '522'
                            classification: NO_THREATS_FOUND
                          - md5: cf075c6a23b807eaa4996d6d01c277a7
                            sha1: 7f0c562176ceaf3170a92036d88bd34e9a801cd2
                            sha256: be76dfb72bc4136df128fbb07384957b3f38566449ce3079584c789b84a0e2f7
                            file_name: 'Chrome Cache Entry: 115'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '755'
                            classification: NO_THREATS_FOUND
                          - md5: f65d136f378cd22eed47c416d1d8097e
                            sha1: f59c9c299939e28f77b1fcd42df7609fc6c529cb
                            sha256: da5fe47c053d2ddf43b3d159330c30276f942e26934da65242d449644414358e
                            file_name: 'Chrome Cache Entry: 146'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '52602'
                            classification: NO_THREATS_FOUND
                          - md5: 32cfd23230827bef1172107322ebf1c2
                            sha1: de9cfa7ceed8645c5ca88cb2fdec046f284a64e4
                            sha256: 358d1c6d7fbebb7831034b12a71814b074ce18955cbe9720eb59e59aff2475fb
                            file_name: 'Chrome Cache Entry: 110'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '10587'
                            classification: NO_THREATS_FOUND
                          - md5: 107694ee1e94990d97b7e58651ffd6a0
                            sha1: 7dd9ae7badf78be01ea0623df1e90171348716ff
                            sha256: 7aa2a3e9a9575a27f5593c3b0357423128c468a46ed20d284ce5a21555ee67bc
                            file_name: 'Chrome Cache Entry: 142'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '13502'
                            classification: NO_THREATS_FOUND
                          - md5: 85a2da1d750e0059a3c08a4d094b675a
                            sha1: e426853f4b86a49614f74ec2e666e9873232cd15
                            sha256: 0580e120a9330564c111a516615dfce6688b253e5558b36bacc8c4fb156cc2d1
                            file_name: 'Chrome Cache Entry: 139'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '725'
                            classification: NO_THREATS_FOUND
                          - md5: 34728207d8866591537b004617ebc934
                            sha1: c2349d2da5e93b32b8b37de746b895d4355da876
                            sha256: 417e432a47f7df09b95a50dd64ea392f008f3a3fe64389234d221fb59ef14f20
                            file_name: 'Chrome Cache Entry: 170'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '36978'
                            classification: NO_THREATS_FOUND
                          - md5: 2fe3d5fbcb0d85c72d064fc69d6414fa
                            sha1: cdb5f75e5341fefd368f11fec82d43f941da518c
                            sha256: 0ac600398c7ff1a29828a0a0c2c77bba481740d8a041bb748d478729166be975
                            file_name: 'Chrome Cache Entry: 137'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '47523'
                            classification: NO_THREATS_FOUND
                          - md5: e6060b137d1dfe31da0f085bb2c43d96
                            sha1: 2f5fcc26fc6c849353876bf0d30054dac90c4b13
                            sha256: bc1db27bc7f386d0eafea8929287ea2259f9b2822c70625f3a5bf6d06f28fcd5
                            file_name: 'Chrome Cache Entry: 131'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '64200'
                            classification: NO_THREATS_FOUND
                          - md5: b8eb82f8f1a5168bda23f13b21751f65
                            sha1: ce95ce03f5881fbd3cae269a63a99f8829eefbce
                            sha256: 7cc8fa06a80d85e6e81664c5388066344710937ed7a7c523e6bd8493370a2e5c
                            file_name: 'Chrome Cache Entry: 147'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '52'
                            classification: NO_THREATS_FOUND
                          - md5: 4aa22f43cf5b185d5ad648417336930a
                            sha1: 8ec35252e56a7e9b33677dafffb01a4882a1c265
                            sha256: 2e923ddab2b03b422400b4bc50509d96965e2b771d6e2c0e69a83de2a61076cf
                            file_name: 'Chrome Cache Entry: 180'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '272'
                            classification: NO_THREATS_FOUND
                          - md5: a2cc15150aa3235c3c2fca095c7a3911
                            sha1: 8fe7e0a6d7982f9e10105902ced583428ea94fac
                            sha256: daf158c1c0be428289e5199c36df8bcc92d8b48ad5c3e667cf7bc42d01fd6638
                            file_name: 'Chrome Cache Entry: 173'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '968'
                            classification: NO_THREATS_FOUND
                          - md5: 05d891e38f3370f062e4195abe1afa01
                            sha1: c283cc04bb05f175e7c93924c751c0e312ef08d3
                            sha256: dd25c89f4ab385f83dce00881072216d9a5de43b7dccb5054023230b2a62abc8
                            file_name: 'Chrome Cache Entry: 117'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '62284'
                            classification: NO_THREATS_FOUND
                          - md5: 95ce0c20696063dadfc8cf1dc44cdf47
                            sha1: a2291d9420333ad7c3b7c33845bbe8514643e551
                            sha256: 7cbf779c4fcee8dbaf068d5c36f90a21b276ba7feaf9b91a214007e0583993bd
                            file_name: 'Chrome Cache Entry: 175'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '2565'
                            classification: NO_THREATS_FOUND
                          - md5: d7875e64ce399e6d217e0b3e78686b1a
                            sha1: be1b97a63e25419e88a2a35d8c29745bc34ae317
                            sha256: 0e33234784c7363536cbdec6437e61f4d4bb899506e077e001092ced8cedbf74
                            file_name: 'Chrome Cache Entry: 130'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '236'
                            classification: NO_THREATS_FOUND
                          - md5: c4fc2a699f5911c8a76801f9cc0e6041
                            sha1: 234fb5423fa474a9ad4e6400aa0bfd234bccd17d
                            sha256: f3de437b6f851aca580c747f36504e7267c60a6909dd365096b8a19c7bc2b6ce
                            file_name: 'Chrome Cache Entry: 134'
                            file_path: ''
                            sample_type: Image/None/JPEG
                            sample_size: '192363'
                            classification: NO_THREATS_FOUND
                          - md5: 7c37aab0f7ab0350cb15a56d032b9bba
                            sha1: a6cca4d093b9301eea1fc137ed68e36cfc0db00f
                            sha256: 77ea2c6fc37cfd08414fa07caaad2d493d43ad3fd0b56a4eeda4cb5f1b2c71f7
                            file_name: 'Chrome Cache Entry: 176'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '36'
                            classification: NO_THREATS_FOUND
                          - md5: 32458f88f092d34824a002527b94039d
                            sha1: 172febe5adb888afe5b4399106f85a3e1c61549a
                            sha256: 633a02efb96d1ceaa92edb95bc3a60ca3723f7e0eceafd702339036c1cd13b71
                            file_name: 'Chrome Cache Entry: 152'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '100'
                            classification: NO_THREATS_FOUND
                          - md5: def00c11b1596db4efee6a9fbe64fc27
                            sha1: bd298981e6d8d7e4ffa18abcf687041f4246672d
                            sha256: 95c427fa3143b1896faf42a6406686ce7602cb39052081bb32d12b51c9e047e4
                            file_name: 'Chrome Cache Entry: 193'
                            file_path: ''
                            sample_type: Image/None/ICO
                            sample_size: '15086'
                            classification: NO_THREATS_FOUND
                          - md5: 0f919241ce6ca5353b6e72df6594f15c
                            sha1: bc7741736c7437952f8533651760f2a6cb68fd50
                            sha256: 14e2446e09e4298f53e2e2a0085a8d7b48466f3fb8ad47ff44f3a262013d8053
                            file_name: 'Chrome Cache Entry: 167'
                            file_path: ''
                            sample_type: Binary/Archive/GZIP
                            sample_size: '2448'
                            classification: NO_THREATS_FOUND
                          - md5: d411a58eee994203cfb4d647cf009036
                            sha1: 12ce16db61af69c6628e45b40412e604cad2e732
                            sha256: 37615f758e77462b1961c4633bf68d233c4ec8dac37d1e3fbca00d1bf93cdf0e
                            file_name: 'Chrome Cache Entry: 171'
                            file_path: ''
                            sample_type: Image/None/PNG
                            sample_size: '61'
                            classification: NO_THREATS_FOUND
                          - md5: 833d9f5b30380a850f15ff9087a48f48
                            sha1: a8bc28674ad85092c2fe8aa4abae4f0a528869b0
                            sha256: 8fe95f6879d583b37ac9507dfbc91f8dacf8112ddceeb8038f25d0f457477e1f
                            file_name: 'Chrome Cache Entry: 109'
                            file_path: ''
                            sample_type: Binary/None
                            sample_size: '3392'
                            classification: NO_THREATS_FOUND
                        signatures:
                          - sig_id: 357
                            risk_factor: 5
                            description: URLs found in memory or binary data
                          - sig_id: 420
                            risk_factor: 5
                            description: Classification label
                          - sig_id: 1734
                            risk_factor: 5
                            description: META copyright field missing
                          - sig_id: 508
                            risk_factor: 0
                            description: Uses secure TLS version
                          - sig_id: 1649
                            risk_factor: 0
                            description: Found graphical window changes (likely an installer)
                          - sig_id: 349
                            risk_factor: 5
                            description: Downloads files from web servers via HTTP
                          - sig_id: 392
                            risk_factor: 5
                            description: Uses HTTPS
                          - sig_id: 353
                            risk_factor: 5
                            description: Performs DNS lookups
                          - sig_id: 1613
                            risk_factor: 0
                            description: Found GUI installer (many successful clicks)
                          - sig_id: 1736
                            risk_factor: 7
                            description: Found iframes
                          - sig_id: 1665
                            risk_factor: 0
                            description: Creates a directory in C:\Program Files
                          - sig_id: 1735
                            risk_factor: 5
                            description: META author tag missing
                          - sig_id: 1549
                            risk_factor: 5
                            description: Uses HTTPS for network communication
                          - sig_id: 1143
                            risk_factor: 5
                            description: Creates files inside the program directory
                          - sig_id: 472
                            risk_factor: 5
                            description: Performs connections to IPs without corresponding DNS lookups
                          - sig_id: 1271
                            risk_factor: 5
                            description: Spawns processes
                          - sig_id: 447
                            risk_factor: 5
                            description: Sends SSDP (simple service discovery protocol) broadcast queries
                        network:
                          http:
                            - url: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=9779.info&pId=130&usid=null&utid=null&query=Newsletter%20Programm&domainJs=ww1.9779.info&path=null&ss=true&lp=2
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTE5NTZhZjc0OGU3MTlmOGIwOTg4ZWUyM2I4MDMwOGMyNjM4&crc=dfb9082f2a48e113fe5b7e80ecf8fad1b63bd1dd&cv=1
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTE5OTA4NzRmZDgzMTczOGQ4NThmYjkxZDhkYzMwMzE2YzFm&crc=e996721c117f8786e9866094a04d3c9dd7b6779a&cv=1
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/caf/?ses=Y3JlPTE3MDQ0NTUxNjUmdGNpZD13dzEuOTc3OS5pbmZvNjU5N2ViZmRlMGNkZDcuNDI0Nzc3MjImdGFzaz1zZWFyY2gmZG9tYWluPTk3NzkuaW5mbyZhX2lkPTMmc2Vzc2lvbj13Q3h4dVlfOVB5V2tSSFhFQlVWQQ%3D%3D&query=Newsletter+Programm&afdToken=ChMIofDyppbGgwMVfIH9Bx3qwAENEmsBlLqpj4W7BtWhAWEpGuLKeRT9aPRdvav9od0cczIFHeft3KzyfDl9My_1YHqCivu1v4_1o2sc2KfGQb0kAjhvwS7zM995r217HSXuqeEFDjvGqMO9IdmM0SOOwRAmOPMlSmE3jeV5M2o7zA&pcsa=false&nb=0&nm=2
                              method: GET
                              process_id: 6772
                            - url: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=9779.info&pId=130&usid=25&utid=4589313320&query=null&domainJs=ww1.9779.info&path=/&ss=true&lp=1
                              method: GET
                              process_id: 6772
                            - url: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=9779.info&pId=130&usid=null&utid=null&query=Mobile%20Abo%20Anbieter&domainJs=ww1.9779.info&path=null&ss=true&lp=2
                              method: GET
                              process_id: 6772
                            - url: http://parking.parklogic.com/page/enhance.js?pcId=2&domain=9779.info
                              method: GET
                              process_id: 6772
                            - url: http://sedo.com/redirect.php?id=22
                              method: GET
                              process_id: 6772
                            - url: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=9779.info&pId=130&usid=null&utid=null&query=Handyanbieter&domainJs=ww1.9779.info&path=null&ss=true&lp=2
                              method: GET
                              process_id: 6772
                            - url: http://img.sedoparking.com/templates/bg/arrows-curved.png
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTE2NTVmOGRiODI3M2FlYTVjMzhlNzEwNGU2Zjk3YmNiN2I0&crc=ece8ee158bff089d3fa965235c1bc180bcac7413&cv=1
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/caf/?ses=Y3JlPTE3MDQ0NTUxNjUmdGNpZD13dzEuOTc3OS5pbmZvNjU5N2ViZmRlMGNkZDcuNDI0Nzc3MjImdGFzaz1zZWFyY2gmZG9tYWluPTk3NzkuaW5mbyZhX2lkPTMmc2Vzc2lvbj13Q3h4dVlfOVB5V2tSSFhFQlVWQQ%3D%3D&query=Handyanbieter&afdToken=ChMIofDyppbGgwMVfIH9Bx3qwAENEmsBlLqpj4DNAgTzN_74x_e-4WCT6FcJ2b-cNBmYE9sIxvXGSUFfPFfT5DJlL3_lKFKA8MLQTvgZ5HDpaYWk337YUI2jAgomT6AXHGMYxDuhVHavi8a_yEaGsL7m97Vh6ESnfRdahCsyIsbOiw&pcsa=false&nb=0&nm=2
                              method: GET
                              process_id: 6772
                            - url: http://img.sedoparking.com/templates/logos/sedo_logo.png
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/?usid=25&utid=4589313320
                              method: GET
                              process_id: 6772
                            - url: http://9779.info/
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/caf/?ses=Y3JlPTE3MDQ0NTUxNjUmdGNpZD13dzEuOTc3OS5pbmZvNjU5N2ViZmRlMGNkZDcuNDI0Nzc3MjImdGFzaz1zZWFyY2gmZG9tYWluPTk3NzkuaW5mbyZhX2lkPTMmc2Vzc2lvbj13Q3h4dVlfOVB5V2tSSFhFQlVWQQ%3D%3D&query=Newsletter+Programm&afdToken=ChMIofDyppbGgwMVfIH9Bx3qwAENEmsBlLqpj4W7BtWhAWEpGuLKeRT9aPRdvav9od0cczIFHeft3KzyfDl9My_1YHqCivu1v4_1o2sc2KfGQb0kAjhvwS7zM995r217HSXuqeEFDjvGqMO9IdmM0SOOwRAmOPMlSmE3jeV5M2o7zA&pcsa=false&nb=0&nm=1
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTIxNDhiODMwYmMyOTdhZjhmZGQ3YzhiZjE1YzU3MWE3ZmFm&crc=f1c9bf8064d8065ea4cf90e21f87033dca1b5dc4&cv=1
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTIwNGMwOTAwNDI3Y2ZjNTQxNjQ0MGI0NDhjZDNkZDBkNDk4&crc=1cc1d8deb22234c0fb97bbffe2d6bb9edde4fc2a&cv=1
                              method: GET
                              process_id: 6772
                            - url: http://ww1.9779.info/caf/?ses=Y3JlPTE3MDQ0NTUxNjUmdGNpZD13dzEuOTc3OS5pbmZvNjU5N2ViZmRlMGNkZDcuNDI0Nzc3MjImdGFzaz1zZWFyY2gmZG9tYWluPTk3NzkuaW5mbyZhX2lkPTMmc2Vzc2lvbj13Q3h4dVlfOVB5V2tSSFhFQlVWQQ%3D%3D&query=Mobile+Abo+Anbieter&afdToken=ChMIofDyppbGgwMVfIH9Bx3qwAENEmwBlLqpj35qxoo91ni0P4Mdq8PqorqfEJ4xK-aMvcSiiVnj1FXeT2Y092bUdvHYNQpZ3VfRbXwAsOpKTyCwNaes5cGIEZm7U3haUPUYcYQqHZhXMtpIHFzm-UxlSNxSX2EDO6HVSTFoaaXoHM8&pcsa=false&nb=0&nm=1
                              method: GET
                              process_id: 6772
                          dns:
                            - type: A (IP address)
                              value: www.google.com
                              address: 216.58.206.36
                              process_id: 6772
                            - type: A (IP address)
                              value: www.sedo.com
                              address: 104.16.141.114
                              process_id: 6772
                            - type: A (IP address)
                              value: api.usercentrics.eu
                              address: 35.241.3.184
                              process_id: 6772
                            - type: A (IP address)
                              value: ww1.9779.info
                              address: 64.190.63.136
                              process_id: 6772
                            - type: '65'
                              value: clients2.google.com
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: 9779.info
                              address: 64.91.240.248
                              process_id: 6772
                            - type: A (IP address)
                              value: challenges.cloudflare.com
                              address: 104.17.3.184
                              process_id: 6772
                            - type: '65'
                              value: sedo.com
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: clients2.google.com
                              address: 142.250.185.142
                              process_id: 6772
                            - type: A (IP address)
                              value: wpad.example.org
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: img.sedoparking.com
                              address: 205.234.175.175
                              process_id: 6772
                            - type: A (IP address)
                              value: sedo.com
                              address: 104.16.141.114
                              process_id: 6772
                            - type: '65'
                              value: api.usercentrics.eu
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: parking.parklogic.com
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: parking.parklogic.com
                              address: 67.225.218.50
                              process_id: 6772
                            - type: A (IP address)
                              value: afs.googleusercontent.com
                              address: 172.217.16.193
                              process_id: 6772
                            - type: '65'
                              value: consent-api.service.consent.usercentrics.eu
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: 9779.info
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: afs.googleusercontent.com
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: www.sedo.com
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: www.google.com
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: accounts.google.com
                              address: 74.125.133.84
                              process_id: 6772
                            - type: '65'
                              value: challenges.cloudflare.com
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: widget.trustpilot.com
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: app.usercentrics.eu
                              address: 35.190.14.188
                              process_id: 6772
                            - type: '65'
                              value: img.sedoparking.com
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: www.adsensecustomsearchads.com
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: www.adsensecustomsearchads.com
                              address: 142.250.185.238
                              process_id: 6772
                            - type: A (IP address)
                              value: cdn.sedo.com
                              address: 104.16.141.114
                              process_id: 6772
                            - type: A (IP address)
                              value: cc.sedoparking.com
                              address: 64.190.63.210
                              process_id: 6772
                            - type: '65'
                              value: accounts.google.com
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: ww1.9779.info
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: cc.sedoparking.com
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: uct.service.usercentrics.eu
                              address: 34.95.108.180
                              process_id: 6772
                            - type: '65'
                              value: cdn.sedo.com
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: consent-api.service.consent.usercentrics.eu
                              address: 35.201.111.240
                              process_id: 6772
                            - type: A (IP address)
                              value: www.freenet-mobilfunk.de
                              address: 172.64.155.50
                              process_id: 6772
                            - type: '65'
                              value: uct.service.usercentrics.eu
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: www.freenet-mobilfunk.de
                              address: none
                              process_id: 6772
                            - type: '65'
                              value: app.usercentrics.eu
                              address: none
                              process_id: 6772
                            - type: A (IP address)
                              value: widget.trustpilot.com
                              address: 52.222.236.60
                              process_id: 6772
                          tcp:
                            - destination_port: 443
                              destination_ip: 216.58.206.36
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 104.17.3.184
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 34.95.108.180
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 142.250.185.142
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 104.16.141.114
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 172.64.155.50
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 35.241.3.184
                              process_id: 6772
                            - destination_port: 80
                              destination_ip: 64.190.63.136
                              process_id: 6772
                            - destination_port: 80
                              destination_ip: 64.91.240.248
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 52.222.236.60
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 35.201.111.240
                              process_id: 6772
                            - destination_port: 80
                              destination_ip: 205.234.175.175
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 74.125.133.84
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 142.250.185.238
                              process_id: 6772
                            - destination_port: 80
                              destination_ip: 104.16.141.114
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 64.190.63.210
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 172.217.16.193
                              process_id: 6772
                            - destination_port: 80
                              destination_ip: 67.225.218.50
                              process_id: 6772
                            - destination_port: 443
                              destination_ip: 35.190.14.188
                              process_id: 6772
                          udp:
                            - destination_port: 1900
                              destination_ip: 239.255.255.250
                              process_id: 2560
                            - destination_port: 53
                              destination_ip: 8.8.8.8
                              process_id: 6772
                            - destination_port: 53
                              destination_ip: 8.8.4.4
                              process_id: 6772
                          url:
                            - url: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=9779.info&pId=130&usid=null&utid=null&query=Mobile%20Abo%20Anbieter&domainJs=ww1.9779.info&path=null&ss=true&lp=2
                              source: network
                            - url: http://ww1.9779.info/caf/?ses=Y3JlPTE3MDQ0NTUxNjUmdGNpZD13dzEuOTc3OS5pbmZvNjU5N2ViZmRlMGNkZDcuNDI0Nzc3MjImdGFzaz1zZWFyY2gmZG9tYWluPTk3NzkuaW5mbyZhX2lkPTMmc2Vzc2lvbj13Q3h4dVlfOVB5V2tSSFhFQlVWQQ%3D%3D&query=Mobile+Abo+Anbieter&afdToken=ChMIofDyppbGgwMVfIH9Bx3qwAENEmwBlLqpj35qxoo91ni0P4Mdq8PqorqfEJ4xK-aMvcSiiVnj1FXeT2Y092bUdvHYNQpZ3VfRbXwAsOpKTyCwNaes5cGIEZm7U3haUPUYcYQqHZhXMtpIHFzm-UxlSNxSX2EDO6HVSTFoaaXoHM8&pcsa=false&nb=0&nm=1
                              source: network
                            - url: http://ww1.9779.info/caf/?ses=Y3JlPTE3MDQ0NTUxNjUmdGNpZD13dzEuOTc3OS5pbmZvNjU5N2ViZmRlMGNkZDcuNDI0Nzc3MjImdGFzaz1zZWFyY2gmZG9tYWluPTk3NzkuaW5mbyZhX2lkPTMmc2Vzc2lvbj13Q3h4dVlfOVB5V2tSSFhFQlVWQQ%3D%3D&query=Newsletter+Programm&afdToken=ChMIofDyppbGgwMVfIH9Bx3qwAENEmsBlLqpj4W7BtWhAWEpGuLKeRT9aPRdvav9od0cczIFHeft3KzyfDl9My_1YHqCivu1v4_1o2sc2KfGQb0kAjhvwS7zM995r217HSXuqeEFDjvGqMO9IdmM0SOOwRAmOPMlSmE3jeV5M2o7zA&pcsa=false&nb=0&nm=2
                              source: network
                            - url: http://ww1.9779.info/caf/?ses=Y3JlPTE3MDQ0NTUxNjUmdGNpZD13dzEuOTc3OS5pbmZvNjU5N2ViZmRlMGNkZDcuNDI0Nzc3MjImdGFzaz1zZWFyY2gmZG9tYWluPTk3NzkuaW5mbyZhX2lkPTMmc2Vzc2lvbj13Q3h4dVlfOVB5V2tSSFhFQlVWQQ%3D%3D&query=Handyanbieter&afdToken=ChMIofDyppbGgwMVfIH9Bx3qwAENEmsBlLqpj4DNAgTzN_74x_e-4WCT6FcJ2b-cNBmYE9sIxvXGSUFfPFfT5DJlL3_lKFKA8MLQTvgZ5HDpaYWk337YUI2jAgomT6AXHGMYxDuhVHavi8a_yEaGsL7m97Vh6ESnfRdahCsyIsbOiw&pcsa=false&nb=0&nm=2
                              source: network
                            - url: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=9779.info&pId=130&usid=$
                              source: memory
                            - url: http://parking.parklogic.com/page/enhance.js?pcId=2&domain=9779.info
                              source: network
                            - url: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=9779.info&pId=130&usid=null&utid=null&query=Newsletter%20Programm&domainJs=ww1.9779.info&path=null&ss=true&lp=2
                              source: network
                            - url: http://ww1.9779.info/?usid=25&utid=4589313320
                              source: network
                            - url: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=9779.info&pId=130&usid=25&utid=4589313320&query=null&domainJs=ww1.9779.info&path=/&ss=true&lp=1
                              source: network
                            - url: http://ww1.9779.info/caf/?ses=Y3JlPTE3MDQ0NTUxNjUmdGNpZD13dzEuOTc3OS5pbmZvNjU5N2ViZmRlMGNkZDcuNDI0Nzc3MjImdGFzaz1zZWFyY2gmZG9tYWluPTk3NzkuaW5mbyZhX2lkPTMmc2Vzc2lvbj13Q3h4dVlfOVB5V2tSSFhFQlVWQQ%3D%3D&query=Newsletter+Programm&afdToken=ChMIofDyppbGgwMVfIH9Bx3qwAENEmsBlLqpj4W7BtWhAWEpGuLKeRT9aPRdvav9od0cczIFHeft3KzyfDl9My_1YHqCivu1v4_1o2sc2KfGQb0kAjhvwS7zM995r217HSXuqeEFDjvGqMO9IdmM0SOOwRAmOPMlSmE3jeV5M2o7zA&pcsa=false&nb=0&nm=1
                              source: network
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTE5OTA4NzRmZDgzMTczOGQ4NThmYjkxZDhkYzMwMzE2YzFm&crc=e996721c117f8786e9866094a04d3c9dd7b6779a&cv=1
                              source: network
                            - url: http://9779.info/
                              source: network
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTIxNDhiODMwYmMyOTdhZjhmZGQ3YzhiZjE1YzU3MWE3ZmFm&crc=f1c9bf8064d8065ea4cf90e21f87033dca1b5dc4&cv=1
                              source: network
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTE5NTZhZjc0OGU3MTlmOGIwOTg4ZWUyM2I4MDMwOGMyNjM4&crc=dfb9082f2a48e113fe5b7e80ecf8fad1b63bd1dd&cv=1
                              source: network
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTE2NTVmOGRiODI3M2FlYTVjMzhlNzEwNGU2Zjk3YmNiN2I0&crc=ece8ee158bff089d3fa965235c1bc180bcac7413&cv=1
                              source: network
                            - url: http://ww1.9779.info/search/tsc.php?200=NTI5OTQ0OTI0&21=MTk0LjE2My4xNTcuNDk=&681=MTcwNDQ1NTIwNGMwOTAwNDI3Y2ZjNTQxNjQ0MGI0NDhjZDNkZDBkNDk4&crc=1cc1d8deb22234c0fb97bbffe2d6bb9edde4fc2a&cv=1
                              source: network
                            - url: http://img.sedoparking.com/templates/bg/arrows-curved.png
                              source: network
                            - url: http://img.sedoparking.com/templates/logos/sedo_logo.png
                              source: network
                            - url: http://sedo.com/redirect.php?id=22
                              source: network
                            - url: http://parking.parklogic.com/page/scribe.php?pcId=2&domain=9779.info&pId=130&usid=null&utid=null&query=Handyanbieter&domainJs=ww1.9779.info&path=null&ss=true&lp=2
                              source: network
                        behavioral:
                          - process:
                              name: chrome.exe
                              parameters: '"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1684,i,1333519164900971791,4046633923457182207,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8'
                              process_id: 6772
                              parent_process_id: 2560
                            mutex_actions:
                              - name: \Sessions\1\BaseNamedObjects\Local\SM0:6772:304:WilStaging_02
                                action_type: mutex_created
                                status: success or wait
                              - name: unknown
                                action_type: mutex_created
                                status: success or wait
                            file_actions:
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: tzres.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: chrome.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\Globalization\Sorting
                                file_name: sortdefault.nls
                                status: success or wait
                                action_type: file_opened
                              - file_path: \Device
                                file_name: KsecDD
                                status: success or wait
                                action_type: file_opened
                              - file_path: \Device\Afd
                                file_name: Endpoint
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32\en-US
                                file_name: tzres.dll.mui
                                status: success or wait
                                action_type: file_opened
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{7F50E9BE-7F02-49EC-B525-546E3FB9A32B}
                                status: success or wait
                                action_type: file_opened
                              - file_path: 'C:'
                                file_name: Users
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: chrome_200_percent.pak
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: Secur32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: chrome_100_percent.pak
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: PROPSYS.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: SSPICLI.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData
                                file_name: Local
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINMMBASE.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data
                                file_name: f_000001
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users
                                file_name: user
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: dhcpcsvc.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: Network Persistent State
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: TransportSecurity~RF31667.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \Device\DeviceApi
                                file_name: CMApi
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: c6505af7-60cd-4edc-bcf9-ac946e710519.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: chrome_elf.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: TransportSecurity
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application
                                file_name: 113.0.5672.93
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: ntmarta.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 851bbcca-131a-4c84-8aa3-38f57d485752.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: \Device\Afd
                                file_name: AsyncConnectHlp
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: VERSION.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data
                                file_name: f_000021
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \Device
                                file_name: RasAcd
                                status: object name not found
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: IPHLPAPI.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: a6bda708-de27-481d-8e26-d7da164ef5c6.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\system32\drivers
                                file_name: etc
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user
                                file_name: AppData
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: b3c6b5d4-4922-4027-8fdc-393fd0e302b2.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\system32\drivers\etc
                                file_name: hosts
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data
                                file_name: f_00001f
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: Network Persistent State~RF2887f.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: ole32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: UIAutomationCore.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: Network Persistent State~RF37291.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: DWrite.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: ''
                                file_name: 'C:'
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data
                                file_name: f_00001e
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\locales
                                file_name: en-US.pak
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local
                                file_name: Google
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: SCT Auditing Pending Reports~RF25fba.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: NLAapi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: CRYPTBASE.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: USERENV.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: mswsock.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINMM.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data
                                file_name: f_000020
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: SCT Auditing Pending Reports
                                status: success or wait
                                action_type: file_moved
                              - file_path: ''
                                file_name: Nsi
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: TransportSecurity~RF36b00.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: dhcpcsvc6.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: crashpad_2560_YWYXSNHJBKNAXJEN
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: DNSAPI.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: bcrypt.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINSPOOL.DRV
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 0fd538ac-8e99-40b5-9d6d-0c6656db1ebf.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: icudtl.dat
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: dbghelp.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{C8C115D0-C73A-11E8-B003-806E6F6E6963}
                                status: object name not found
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 76645e9b-45f7-4cf5-aa14-9e1f48ecd88d.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: v8_context_snapshot.bin
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: Network Persistent State~RF34893.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 5aa47892-9635-4288-9b66-e471a8469759.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: SCT Auditing Pending Reports~RF26027.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: 814f0420-fb15-4094-97b1-e01739c06f98.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINNSI.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINHTTP.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: resources.pak
                                status: success or wait
                                action_type: file_opened
                              - file_path: \Device
                                file_name: CNG
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: IMM32.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: ''
                                file_name: unknown
                                status: success or wait
                                action_type: file_written
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
                                file_name: TransportSecurity~RF28ae1.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Windows\System32
                                file_name: rasadhlp.dll
                                status: success or wait
                                action_type: file_opened
                            registry_actions:
                              - key_name: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                            modules_loaded:
                              - module_name: \KnownDlls\DWrite.dll
                                module_tag: ''
                              - module_name: \KnownDlls\USER32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\combase.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\secur32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\Secur32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\dbghelp.dll
                                module_tag: ''
                              - module_name: \KnownDlls\kernel.appcore.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dhcpcsvc.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ntmarta.dll
                                module_tag: ''
                              - module_name: \KnownDlls\msvcp_win.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\en-US\tzres.dll.mui
                                module_tag: ''
                              - module_name: \KnownDlls\CRYPTBASE.DLL
                                module_tag: ''
                              - module_name: unknown
                                module_tag: ''
                              - module_name: \KnownDlls\OLEAUT32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\rasadhlp.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\userenv.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\bcrypt.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\rasadhlp.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\winnsi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WS2_32.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\nlaapi.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\ntmarta.dll
                                module_tag: ''
                              - module_name: \KnownDlls\UIAutomationCore.DLL
                                module_tag: ''
                              - module_name: C:\Windows\System32\version.dll
                                module_tag: ''
                              - module_name: \KnownDlls\profapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\NSI.dll
                                module_tag: ''
                              - module_name: \KnownDlls\gdi32full.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\DWrite.dll
                                module_tag: ''
                              - module_name: \KnownDlls\USERENV.dll
                                module_tag: ''
                              - module_name: \KnownDlls\VERSION.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\cryptbase.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dhcpcsvc6.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ucrtbase.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\winmmbase.dll
                                module_tag: ''
                              - module_name: \KnownDlls\DNSAPI.dll
                                module_tag: ''
                              - module_name: \KnownDlls\SSPICLI.DLL
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\chrome_100_percent.pak
                                module_tag: ''
                              - module_name: C:\Windows\System32\ole32.dll
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\chrome_200_percent.pak
                                module_tag: ''
                              - module_name: C:\Windows\System32\UIAutomationCore.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WINMM.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\propsys.dll
                                module_tag: ''
                              - module_name: \KnownDlls\CRYPT32.dll
                                module_tag: ''
                              - module_name: \Sessions\1\Windows\SharedSection
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\resources.pak
                                module_tag: ''
                              - module_name: \KnownDlls\dhcpcsvc.DLL
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\chrome.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WINNSI.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\sechost.dll
                                module_tag: ''
                              - module_name: \KnownDlls\cfgmgr32.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\mswsock.dll
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\v8_context_snapshot.bin
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\icudtl.dat
                                module_tag: ''
                              - module_name: \KnownDlls\bcrypt.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ADVAPI32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WINTRUST.dll
                                module_tag: ''
                              - module_name: \KnownDlls\KERNELBASE.dll
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\Locales\en-US.pak
                                module_tag: ''
                              - module_name: \KnownDlls\bcryptPrimitives.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dbghelp.dll
                                module_tag: ''
                              - module_name: \KnownDlls\PROPSYS.dll
                                module_tag: ''
                              - module_name: \KnownDlls\shcore.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dnsapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\FLTLIB.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\WINHTTP.dll
                                module_tag: ''
                              - module_name: \KnownDlls\mswsock.dll
                                module_tag: ''
                              - module_name: \KnownDlls\winmmbase.dll
                                module_tag: ''
                              - module_name: \KnownDlls\msvcrt.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\imm32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WINSPOOL.DRV
                                module_tag: ''
                              - module_name: \KnownDlls\windows.storage.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WINMMBASE.dll
                                module_tag: ''
                              - module_name: \KnownDlls\KERNEL32.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\MSASN1.dll
                                module_tag: ''
                              - module_name: \KnownDlls\powrprof.dll
                                module_tag: ''
                              - module_name: \KnownDlls\shlwapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\win32u.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\winmm.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\IPHLPAPI.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\dhcpcsvc6.DLL
                                module_tag: ''
                              - module_name: C:\Windows\System32\winhttp.dll
                                module_tag: ''
                              - module_name: \KnownDlls\RPCRT4.dll
                                module_tag: ''
                              - module_name: \KnownDlls\shell32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\IMM32.DLL
                                module_tag: ''
                              - module_name: C:\Windows\Globalization\Sorting\SortDefault.nls
                                module_tag: ''
                              - module_name: \KnownDlls\NLAapi.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\sspicli.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\winspool.drv
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\chrome_elf.dll
                                module_tag: ''
                              - module_name: \KnownDlls\IPHLPAPI.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\GDI32.dll
                                module_tag: ''
                          - process:
                              name: chrome.exe
                              parameters: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "http://9779.info/
                              process_id: 4444
                              parent_process_id: 3408
                            mutex_actions:
                              - name: unknown
                                action_type: mutex_created
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\SM0:4444:304:WilStaging_02
                                action_type: mutex_created
                                status: success or wait
                            file_actions:
                              - file_path: \Device\DeviceApi
                                file_name: CMApi
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)
                                file_name: AutoIt3
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\Globalization\Sorting
                                file_name: sortdefault.nls
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: chrome_elf.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application
                                file_name: 113.0.5672.93
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: ntmarta.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome
                                file_name: Application
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: VERSION.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: CRYPTBASE.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: IMM32.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: crashpad_4444_GOHEPPDLTTIWISAW
                                status: success or wait
                                action_type: file_opened
                              - file_path: \Device
                                file_name: CNG
                                status: success or wait
                                action_type: file_opened
                            registry_actions:
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
                                status: success or wait
                                value_name: StatusCodes
                                value: 'NU LL '
                                action_type: key_value_modified
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
                                status: success or wait
                                value_name: state
                                value: '2'
                                action_type: key_value_modified
                            process_actions:
                              - path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                status: success or wait
                                action_type: process_terminated
                              - path: unknown
                                status: success or wait
                                action_type: process_created
                            modules_loaded:
                              - module_name: \KnownDlls\profapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\windows.storage.dll
                                module_tag: ''
                              - module_name: \KnownDlls\gdi32full.dll
                                module_tag: ''
                              - module_name: \KnownDlls\msvcp_win.dll
                                module_tag: ''
                              - module_name: \KnownDlls\KERNEL32.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\combase.dll
                                module_tag: ''
                              - module_name: \KnownDlls\shcore.dll
                                module_tag: ''
                              - module_name: \KnownDlls\VERSION.dll
                                module_tag: ''
                              - module_name: \KnownDlls\shlwapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\sechost.dll
                                module_tag: ''
                              - module_name: C:\Windows\Globalization\Sorting\SortDefault.nls
                                module_tag: ''
                              - module_name: \KnownDlls\cfgmgr32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\RPCRT4.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\cryptbase.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ucrtbase.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ntmarta.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ADVAPI32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\USER32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\KERNELBASE.dll
                                module_tag: ''
                              - module_name: \KnownDlls\CRYPTBASE.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\kernel.appcore.dll
                                module_tag: ''
                              - module_name: \KnownDlls\IMM32.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\bcryptPrimitives.dll
                                module_tag: ''
                              - module_name: \KnownDlls\win32u.dll
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\chrome_elf.dll
                                module_tag: ''
                              - module_name: \KnownDlls\FLTLIB.DLL
                                module_tag: ''
                              - module_name: C:\Windows\System32\ntmarta.dll
                                module_tag: ''
                              - module_name: \KnownDlls\SHELL32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\msvcrt.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\version.dll
                                module_tag: ''
                              - module_name: \KnownDlls\powrprof.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\imm32.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\windows_shell_global_counters
                                module_tag: ''
                              - module_name: \Sessions\1\Windows\SharedSection
                                module_tag: ''
                              - module_name: \KnownDlls\GDI32.dll
                                module_tag: ''
                          - process:
                              name: chrome.exe
                              parameters: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"  --start-maximized  "about:blank
                              process_id: 2560
                              parent_process_id: 3408
                            mutex_actions:
                              - name: \Sessions\1\BaseNamedObjects\Local\SM0:2560:304:WilStaging_02
                                action_type: mutex_created
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_Speech_OneCore_Voices_Tokens_MSTTS_V110_enUS_ZiraM_Mutex
                                action_type: mutex_created
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_Speech_OneCore_Voices_Tokens_MSTTS_V110_enUS_MarkM_Mutex
                                action_type: mutex_created
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}
                                action_type: mutex_created
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_Speech_OneCore_Voices_Tokens_MSTTS_V110_enUS_DavidM_Mutex
                                action_type: mutex_created
                                status: success or wait
                              - name: unknown
                                action_type: mutex_created
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\SM0:2560:120:WilError_01
                                action_type: mutex_created
                                status: success or wait
                              - name: \Sessions\1\BaseNamedObjects\Local\ChromeProcessSingletonStartup!
                                action_type: mutex_created
                                status: success or wait
                            file_actions:
                              - file_path: C:\Program Files (x86)
                                file_name: AutoIt3
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\resources\hangout_services\_metadata
                                file_name: computed_hashes.json
                                status: object path not found
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: lv
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 832d135b-0718-474b-a09e-b9d0296d6833.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: gu
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache
                                file_name: upgrade-index
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\FONTS
                                file_name: COURBD.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: todelete_d7836e800def8c08
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
                                file_name: caff16cd805b2a90_0
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user~1\AppData
                                file_name: Local
                                status: success or wait
                                action_type: file_opened
                              - file_path: \Device\DeviceApi
                                file_name: CMApi
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Windows\System32
                                file_name: Windows.UI.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIAL.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome
                                file_name: Application
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files\Google\GoogleUpdater
                                file_name: prefs.json
                                status: object path not found
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: pl
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: VERSION.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: km
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: ntshrui.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.4724288272483745025
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: lv
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
                                file_name: craw_window.css
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application
                                file_name: SetupMetrics
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\uk
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: KBDUS.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\resources\pdf\_metadata
                                file_name: computed_hashes.json
                                status: object path not found
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: trusted_vault.pb~RF26373.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: hu
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\tr
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user
                                file_name: AppData
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: zh_TW
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.18029471012267369370
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ko
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: ja
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
                                file_name: LOG.old~RF25a99.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata
                                file_name: verified_contents.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hu
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: nb
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32\en-US
                                file_name: tzres.dll.mui
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ml
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.12396418875192769969
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: msvcp110_win.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0
                                file_name: page_embed_script.js
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata
                                file_name: computed_hashes.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.5928.8536873739508622263
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.10557085982688863846
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application
                                file_name: 113.0.5672.93
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi
                                file_name: 1.66.0_0
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGUISYM.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: id
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: af
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr_CA
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: vi
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\Caches
                                file_name: cversions.1.db
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: de
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.9555045876258489152
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ca
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
                                file_name: Tabs_13341351141015311
                                status: success or wait
                                action_type: file_deleted
                              - file_path: ''
                                file_name: unknown
                                status: invalid handle
                                action_type: file_written
                              - file_path: C:\Users
                                file_name: user~1
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\System32
                                file_name: cscui.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: Caches
                                status: object name collision
                                action_type: file_created
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: cryptsp.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: dwmapi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.6613295329382304839
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Windows\System32
                                file_name: WindowsCodecsRaw.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: topbar_floating_button_maximize.png
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: en_GB
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\si
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.15407119352552976669
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ur
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: 'C:'
                                file_name: Users
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: gpapi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: dhcpcsvc.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences~RF277c6.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata
                                file_name: verified_contents.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Windows\System32
                                file_name: ActXPrxy.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: fil
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 4f27f3c2-a4a1-4646-a946-4fc3de9560d7.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
                                file_name: LOG.old~RF268d2.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.5928.4764792344214902497
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.7818541733707887348
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\Globalization\Sorting
                                file_name: sortdefault.nls
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: gl
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: fi
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Windows\System32
                                file_name: RTWorkQ.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: tr
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: twinapi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: en
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\locales
                                file_name: en-US.pak
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: zh_CN
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: es_419
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Windows\System32
                                file_name: inetcomm.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: dbghelp.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0
                                file_name: _locales
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: pa
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: chrome_100_percent.pak
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 8c4aa6c0-01d4-4f14-8141-63114a6a8347.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Windows\System32
                                file_name: twinapi.appcore.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: BitsProxy.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: bn
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: tr
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: chrome_200_percent.pak
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: dlnashext.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: iw
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: SSPICLI.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: fwbase.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: sl
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WTSAPI32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ms
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sw
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: ''
                                file_name: MountPointManager
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: eu
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIALBI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database
                                file_name: LOG.old~RF25579.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\System32\en-US
                                file_name: KERNEL32.DLL.mui
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Local State~RF347a9.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.5928.2297125665576315697
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Module Info Cache~RF37d3f.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.15590532038925063504
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: css
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences~RF36fa3.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.14097890428321875181
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGUISLI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 7132f64d-2203-4ca8-b811-18516ed90b4d.tmp
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: en_US
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 1cc860db-bedf-4f22-8962-1fe66fc76e48.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: pt_BR
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.5782583354670776181
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: a37a95b6-a6d2-445f-b9e7-407fda93336b.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: topbar_floating_button_pressed.png
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: mscms.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.5416878491400471476
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\th
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.7717486064321301637
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics
                                file_name: BrowserMetrics-65244C60-125C.pma
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: Secur32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
                                file_name: LOG.old~RF25867.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: topbar_floating_button_hover.png
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: bcrypt.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: it
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: ca
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGOEUIZ.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ka
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: kk
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: wlanapi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.2689436931866974600
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: it
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gdaefkejpgkiemlaofpalmlakkmbjdnl
                                file_name: 000001.dbtmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: default_apps
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIALI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.11432008513870508582
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.9100526833695549847
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: sr
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.10014133229430292280
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Windows\System32
                                file_name: FirewallAPI.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics
                                file_name: BrowserMetrics-65986994-A00.pma
                                status: cannot delete
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINHTTP.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32\spool\drivers\color
                                file_name: sRGB Color Space Profile.icm
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ta
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.5928.11832217247215802255
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\PROGRA~1\MICROS~1\Office12
                                file_name: MSOHEVI.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.16136138026596124204
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: IPHLPAPI.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: 'no'
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: zh_TW
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: images
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sv
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINSTA.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIALBD.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: hr
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: tbs.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: srmshell.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.3980198304545732233
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: sk
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: dxgi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: USERENV.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\System32
                                file_name: wkscli.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: sr
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\te
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0
                                file_name: manifest.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
                                file_name: bfc3761f-a788-4a60-8860-db27b3bf6826
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: chrome.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hy
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Windows\System32
                                file_name: webcheck.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: craw_window.js
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGUISBI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: fil
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \Device\Afd
                                file_name: Endpoint
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: usermgrcli.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: TIMESBI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: te
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.5928.5828218928108390655
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\MEIPreload
                                file_name: manifest.json
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: WorkfoldersShell.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.15635617697843277301
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: icon_16.png
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.10978308385046616234
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: TIMES.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: e7c93665-3c1c-445c-a8d3-3715069cf5e0.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
                                file_name: LOG.old~RF255b7.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: dataexchange.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: si
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: _metadata
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: DWrite.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: ru
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: kn
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files\Windows Defender
                                file_name: shellext.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGOEUIB.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: th
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.6299547662947798714
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: hi
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files
                                file_name: chrome_BITS_2560_1785449465
                                status: success or wait
                                action_type: file_created
                              - file_path: C:\WINDOWS\system32
                                file_name: CoreUIComponents.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: sl
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: PCPKsp.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.8554484992707884714
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: \pipe
                                file_name: mojo.2560.5928.10614421674840858585
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache
                                file_name: index~RF25867.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINMMBASE.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My
                                file_name: Certificates
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.10540057491381416686
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_HK
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: MDMRegistration.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata
                                file_name: computed_hashes.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows\Caches
                                file_name: '{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db'
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: ntmarta.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: zu
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Secure Preferences~RF27778.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: CONSOLAZ.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\km
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIBLK.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: topbar_floating_button.png
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: db8576bf-f3fc-43be-98cf-a489efef9795.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\system32
                                file_name: NLAapi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: wkssvc
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINMM.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: wshext.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: ro
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.11923296251697574931
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{7F50E9BE-7F02-49EC-B525-546E3FB9A32B}
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.2149821592548076916
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Windows\System32
                                file_name: colorui.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 391132ab-a688-406d-961f-18a2d0bfd40f.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: en_GB
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.11760936198732916795
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12
                                file_name: msoshext.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGUIEMJ.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences~RF2df98.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
                                file_name: LOG.old~RF268d2.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: manifest.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ar
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: topbar_floating_button_close.png
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\System32
                                file_name: CRYPTSP.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.3178341202110984037
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGOEUII.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: nl
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_BR
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ja
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: msdmo.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: CAMBRIA.TTC
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
                                file_name: LOG.old~RF25077.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: da
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\System32
                                file_name: DPAPI.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: 'C:'
                                file_name: WINDOWS
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: lt
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files\Common Files\System
                                file_name: wab32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: the-real-index~RF2b0e7.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
                                file_name: LOG.old~RF26901.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.450867070990279599
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: es
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0
                                file_name: _metadata
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: lo
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: CRYPTBASE.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: MSACM32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0
                                file_name: 128.png
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: TIMESI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: crashpad_2560_YWYXSNHJBKNAXJEN
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My
                                file_name: CTLs
                                status: success or wait
                                action_type: file_opened
                              - file_path: ''
                                file_name: TPM
                                status: object name not found
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\System32
                                file_name: MMDevApi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Local State
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\resources\web_store\_metadata
                                file_name: computed_hashes.json
                                status: object path not found
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: uk
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: _locales
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: \pipe
                                file_name: mojo.2560.3004.8876640039809901733
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ne
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users
                                file_name: user
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.5928.4125600767827796724
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Local State~RF27601.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: html
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: pt_PT
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: th
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\WidevineCdm
                                file_name: manifest.json
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local
                                file_name: Google
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: fr
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGOEUIL.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: cryptext.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32\en-US
                                file_name: PROPSYS.dll.mui
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lo
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.15958282659113286018
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.6687549392530257385
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: dhcpcsvc6.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: VERDANAI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.8294733197747342523
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.10609475195780774053
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: XmlLite.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: CONSOLAB.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.683619091039986891
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: ncryptprov.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: \pipe
                                file_name: mojo.2560.5928.17140392494735311710
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: mr
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: pt_PT
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: trusted_vault.pb
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gl
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions
                                file_name: ghbmnnjooekpmoecnnnilnnbdlolhkhi
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: PROPSYS.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData
                                file_name: Local
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: temp-index
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\FONTS
                                file_name: VERDANAZ.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: VERDANAB.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
                                file_name: LOG.old~RF268f1.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: fi
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: ncrypt.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: my
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0
                                file_name: eventpage_bin_prod.js
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: el
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32\drivers
                                file_name: etc
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.5970163548780284289
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.7432119988439962108
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ro
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: icon_128.png
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0
                                file_name: dasherSettingSchema.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.16674362759453457357
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: UIAutomationCore.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\System32\en-US
                                file_name: USER32.dll.mui
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: vi
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
                                file_name: Google Chrome.lnk
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.7244759527977089726
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGUIBLI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions
                                file_name: nmmhkkegccagdldgiimedpiccmgmieda
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Windows\System32
                                file_name: RMCLIENT.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hi
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
                                file_name: craw_background.js
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: CONSOLAI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: et
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: en
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
                                file_name: LOG.old~RF25077.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: CONSOLA.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Secure Preferences
                                status: success or wait
                                action_type: file_moved
                              - file_path: \pipe
                                file_name: mojo.2560.3004.7020591011993536372
                                status: success or wait
                                action_type: file_opened
                              - file_path: \Device
                                file_name: CNG
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: tzres.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Local State~RF300bc.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\WinSxS
                                file_name: amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17134.320_none_fb3d992f3069e403
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\MEIPreload
                                file_name: preloaded_data.pb
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: pt_BR
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
                                file_name: LOG.old~RF268c2.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: chrome_elf.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.15903869520996538939
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sk
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \Device\DeviceApi
                                file_name: CMNotify
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Microsoft\Windows
                                file_name: Caches
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: appresolver.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: wpnapps.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32\drivers\etc
                                file_name: hosts
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Windows\System32
                                file_name: InputHost.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Module Info Cache~RF2a917.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\it
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\system32
                                file_name: CoreMessaging.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user~1
                                file_name: AppData
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.14749609870497982574
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: Module Info Cache
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\system32
                                file_name: IMM32.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: stobject.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: e17cd667-52cd-4383-af0a-7549e34a8a12.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\system32
                                file_name: TextInputFramework.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
                                file_name: LOG.old~RF250b6.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir
                                file_name: the-real-index
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences~RF347a9.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: el
                                status: success or wait
                                action_type: file_deleted
                              - file_path: ''
                                file_name: STORAGE#Volume#{45fd10d4-cc21-11e8-b00f-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: pl
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: sw
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: fr
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \Device
                                file_name: KsecDD
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Windows\System32
                                file_name: OneCoreUAPCommonProxyStub.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: uk
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.15065099317789301088
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.3004.2513007212336524037
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.1004780901871782327
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\System32
                                file_name: netutils.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: nl
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: DMCmnUtils.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIALN.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache
                                file_name: index
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIALNB.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: zh_HK
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.4363029957224227292
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: TIMESBD.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ur
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: d3d11.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: atlthunk.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: NTASN1.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: cs
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ru
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0
                                file_name: manifest.fingerprint
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: rpcss.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
                                file_name: LOG.old~RF268b3.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: sv
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: COURBI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: de
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.5157722053991392029
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: wlanapi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\default_apps
                                file_name: external_extensions.json
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17134.320_none_fb3d992f3069e403
                                file_name: COMCTL32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
                                file_name: LOG.old~RF26910.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: be
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: resources.pak
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: 9c5130d0-ce03-486f-beea-734b1fec9655.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: sk
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIALNI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
                                file_name: LOG.old~RF260f2.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\Registration
                                file_name: R000000000013.clb
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: chrome_shutdown_ms.txt
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: et
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pa
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\resources\network_speech_synthesis\_metadata
                                file_name: computed_hashes.json
                                status: object path not found
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: bg
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: az
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
                                file_name: LOG.old~RF26901.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: shell32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: cy
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: en_CA
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: OLEACC.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
                                file_name: Session_13341351140337548
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: ARIALNBI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: Preferences~RF31abd.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGUISB.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.676689459595623519
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: hi
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
                                file_name: flapper.gif
                                status: success or wait
                                action_type: file_deleted
                              - file_path: ''
                                file_name: STORAGE#Volume#{45fd10d4-cc21-11e8-b00f-806e6f6e6963}#0000000022600000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                status: success or wait
                                action_type: file_opened
                              - file_path: \DEVICE
                                file_name: NETBT_TCPIP_{C8C115D0-C73A-11E8-B003-806E6F6E6963}
                                status: object name not found
                                action_type: file_opened
                              - file_path: C:\WINDOWS\System32\Speech\Common
                                file_name: sapi.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My
                                file_name: CRLs
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
                                file_name: LOG.old~RF256a2.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: explorerframe.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\FONTS
                                file_name: COURI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.8927958104706125095
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: hy
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: ko
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGOEUISL.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ru
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: fr_CA
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: uxtheme.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: Windows.Media.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: fa
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.5928.15419401526727606107
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
                                file_name: 1.0.0.6_0
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.3004.8336295015124970699
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: hu
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGUILI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Windows\System32
                                file_name: EhStorShell.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\vi
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: is
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGUIBL.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
                                file_name: LOG.old~RF25a99.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: LINKINFO.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: es_419
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: mswsock.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: netapi32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                file_name: b7d74a3f-c673-4542-a1b7-cd1a7361f351.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: da
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: am
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: WINSPOOL.DRV
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.5928.10768073489644983878
                                status: success or wait
                                action_type: file_opened
                              - file_path: ''
                                file_name: 'C:'
                                status: success or wait
                                action_type: file_opened
                              - file_path: \pipe
                                file_name: mojo.2560.5928.17927838384546240916
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: zh_CN
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
                                file_name: LOG.old~RF25068.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: DEVOBJ.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: wintypes.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: sv
                                status: success or wait
                                action_type: file_deleted
                              - file_path: \pipe
                                file_name: mojo.2560.5928.17969900894641679541
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\system32
                                file_name: rsaenh.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: DSREG.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ro
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
                                file_name: LOG.old~RF25104.TMP
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: VERDANA.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: ole32.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My
                                file_name: AppContainerUserCertRead
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: mn
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: cs
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\system32
                                file_name: directmanipulation.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: es
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)
                                file_name: desktop.ini
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
                                file_name: LOG
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales
                                file_name: bg
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: ColorAdapterClient.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: lt
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data
                                file_name: 7d4ed47b-6d90-4505-9f3a-3e36f67096cb.tmp
                                status: success or wait
                                action_type: file_moved
                              - file_path: \pipe
                                file_name: mojo.2560.3004.10431516778948173293
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: hr
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\SYSTEM32
                                file_name: OLEACCRC.DLL
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS
                                file_name: WindowsShell.Manifest
                                status: success or wait
                                action_type: file_opened
                              - file_path: ''
                                file_name: Nsi
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
                                file_name: craw_window.html
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: SEGOEUI.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
                                file_name: LOG.old
                                status: success or wait
                                action_type: file_moved
                              - file_path: C:\WINDOWS\system32
                                file_name: dcomp.dll
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\WINDOWS\FONTS
                                file_name: COUR.TTF
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg
                                file_name: messages.json
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93
                                file_name: icudtl.dat
                                status: success or wait
                                action_type: file_opened
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: id
                                status: success or wait
                                action_type: file_deleted
                              - file_path: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales
                                file_name: ko
                                status: success or wait
                                action_type: file_deleted
                            registry_actions:
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463c-AFF1-A69D9E530F96}\LastWasDefault
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_USERSS-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
                                status: success or wait
                                value_name: prefs.preference_reset_time
                                value: 94F01EE0B385323778FB1E024E1EA86C5068E08F4A5C423D112E6F5A9523F535
                                action_type: key_value_created
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PriorityControl
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
                                status: success or wait
                                value_name: S-1-5-21-987036132-2528391375-4088684000-1001
                                value: '09 94 D2 29 CF 6C 2F 00 '
                                action_type: key_value_created
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
                                status: success or wait
                                value_name: user_experience_metrics.stability.exited_cleanly
                                value: '0'
                                action_type: key_value_modified
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_deleted
                              - key_name: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Voices
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_created
                              - key_name: HKEY_USERSS-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry
                                status: success or wait
                                value_name: TraceTimeLast
                                value: 'B1 75 D3 A3 17 40 DA 01 '
                                action_type: key_value_modified
                              - key_name: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech\Voices
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
                                status: success or wait
                                value_name: lastrun
                                value: '13348960918955918'
                                action_type: key_value_modified
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Chrome\Extensions
                                status: object name not found
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Chrome\Extensions
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Chrome
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_created
                              - key_name: HKEY_CURRENT_USER\Software\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_created
                              - key_name: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463c-AFF1-A69D9E530F96}\LastWasDefault
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_created
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
                                status: success or wait
                                value_name: state
                                value: '2'
                                action_type: key_value_modified
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\Extensions
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Control Panel\Cursors
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
                                status: success or wait
                                value_name: StatusCodes
                                value: 'NU LL '
                                action_type: key_value_modified
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Speech_OneCore\Voices
                                status: success or wait
                                value_name: DefaultTokenId
                                value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_DavidM
                                action_type: key_value_created
                              - key_name: HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
                                status: success or wait
                                value_name: ahfgeienlihckogmohjhadlkjgocpleb
                                value: C3FB6B8CF23C5C487CDE0BB020A74CC2E19AE55ABB4EF2436B427494493237A7
                                action_type: key_value_created
                              - key_name: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault
                                status: success or wait
                                value_name: S-1-5-21-987036132-2528391375-4088684000-1001
                                value: '69 3A F6 29 CF 6C 2F 00 '
                                action_type: key_value_modified
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463c-AFF1-A69D9E530F96}
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\Extensions
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_CURRENT_USER\
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\FirstNotDefault
                                status: success or wait
                                value_name: S-1-5-21-987036132-2528391375-4088684000-1001
                                value: ''
                                action_type: key_value_deleted
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
                                status: object name not found
                                value_name: extensions.settings
                                value: ''
                                action_type: key_value_deleted
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Chrome\Extensions
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_created
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default
                                status: success or wait
                                value_name: media.cdm.origin_data
                                value: 81046E921B34925EF9312C9A62CC5AFFB0D63E7CA2C13AC486278B291F7C08F2
                                action_type: key_value_modified
                              - key_name: HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
                                status: success or wait
                                value_name: ''
                                value: ''
                                action_type: key_opened
                              - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
                                status: pending
                                value_name: ''
                                value: ''
                                action_type: key_monitored
                            process_actions:
                              - path: unknown
                                status: success or wait
                                action_type: process_created
                              - path: unknown
                                status: process is terminating
                                action_type: process_terminated
                              - path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                                status: success or wait
                                action_type: process_created
                            modules_loaded:
                              - module_name: \KnownDlls\DWrite.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dpapi.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\seguisbi.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\USER32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\combase.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\HWNDInterface:302ce
                                module_tag: ''
                              - module_name: C:\Windows\System32\secur32.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dsreg.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\rpcss.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\winsta.dll
                                module_tag: ''
                              - module_name: \KnownDlls\Secur32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\dbghelp.dll
                                module_tag: ''
                              - module_name: \KnownDlls\rsaenh.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\arial.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\kernel.appcore.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\uxtheme.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\devobj.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\twinapi.appcore.dll
                                module_tag: ''
                              - module_name: \KnownDlls\XmlLite.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dhcpcsvc.dll
                                module_tag: ''
                              - module_name: \KnownDlls\msvcp110_win.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ntmarta.dll
                                module_tag: ''
                              - module_name: \KnownDlls\msvcp_win.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\cour.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\MMDevApi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WINSTA.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\ncryptprov.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\ariblk.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\PCPKsp.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\en-US\tzres.dll.mui
                                module_tag: ''
                              - module_name: \KnownDlls\WINHTTP.dll
                                module_tag: ''
                              - module_name: \KnownDlls\CRYPTBASE.DLL
                                module_tag: ''
                              - module_name: C:\Windows\System32\dcomp.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\ARIALNB.TTF
                                module_tag: ''
                              - module_name: unknown
                                module_tag: ''
                              - module_name: \KnownDlls\OLEAUT32.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*Users*user*AppData*Local*Microsoft*Windows*Caches*cversions.1.ro
                                module_tag: ''
                              - module_name: \KnownDlls\d3d11.dll
                                module_tag: ''
                              - module_name: \KnownDlls\wlanapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\usermgrcli.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\en-US\kernel32.dll.mui
                                module_tag: ''
                              - module_name: C:\Windows\System32\TextInputFramework.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\segoeuiz.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\ncrypt.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\nlaapi.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\segoeui.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\MMDevAPI.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\seguibl.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\actxprxy.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\ntmarta.dll
                                module_tag: ''
                              - module_name: \KnownDlls\SHELL32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\UIAutomationCore.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\CoreUIComponents.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\consolai.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\version.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\arialbi.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\winhttp.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\linkinfo.dll
                                module_tag: ''
                              - module_name: \KnownDlls\explorerframe.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ActXPrxy.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\mdmregistration.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\CoreUIComponents.dll
                                module_tag: ''
                              - module_name: \KnownDlls\wpnapps.dll
                                module_tag: ''
                              - module_name: \KnownDlls\InputHost.dll
                                module_tag: ''
                              - module_name: \KnownDlls\dwmapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\MSACM32.dll
                                module_tag: ''
                              - module_name: C:\Windows\Registration\R000000000013.clb
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Global\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\verdana.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\RTWorkQ.dll
                                module_tag: ''
                              - module_name: \KnownDlls\profapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WINSPOOL.DRV
                                module_tag: ''
                              - module_name: \KnownDlls\gdi32full.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Global\C:*ProgramData*Microsoft*Windows*Caches*cversions.2
                                module_tag: ''
                              - module_name: C:\Windows\System32\wtsapi32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\uxtheme.dll
                                module_tag: ''
                              - module_name: \KnownDlls\shcore.dll
                                module_tag: ''
                              - module_name: \KnownDlls\USERENV.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\en-US\user32.dll.mui
                                module_tag: ''
                              - module_name: \KnownDlls\VERSION.dll
                                module_tag: ''
                              - module_name: \Windows\Theme2556678861
                                module_tag: ''
                              - module_name: \Sessions\1\Windows\ThemeSection
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Global\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db
                                module_tag: ''
                              - module_name: C:\Windows\System32\mscms.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\courbi.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\cryptbase.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dhcpcsvc6.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ucrtbase.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm
                                module_tag: ''
                              - module_name: \KnownDlls\SETUPAPI.dll
                                module_tag: ''
                              - module_name: \KnownDlls\NLAapi.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\coloradapterclient.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\segoeuii.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\mswsock.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\timesbd.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\SSPICLI.DLL
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\chrome_100_percent.pak
                                module_tag: ''
                              - module_name: C:\Windows\System32\msvcp110_win.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\HWNDInterface:1032a
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\seguisb.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\ole32.dll
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\chrome_200_percent.pak
                                module_tag: ''
                              - module_name: C:\Windows\System32\UIAutomationCore.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ncrypt.dll
                                module_tag: ''
                              - module_name: \KnownDlls\tbs.dll
                                module_tag: ''
                              - module_name: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17134.320_none_fb3d992f3069e403\comctl32.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\xmllite.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\CoreMessaging.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\twinapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\dataexchange.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\verdanai.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\MSCTF.dll
                                module_tag: ''
                              - module_name: \KnownDlls\msdmo.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\consola.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\WINMM.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\msdmo.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\usermgrcli.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\gpapi.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\propsys.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\seguili.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\twinapi.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\AsyncKeyStateTrackerSharedMemory
                                module_tag: ''
                              - module_name: C:\Windows\System32\tbs.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\oleacc.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\ariali.ttf
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\seguibli.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\Windows.Media.dll
                                module_tag: ''
                              - module_name: \KnownDlls\Windows.UI.dll
                                module_tag: ''
                              - module_name: \KnownDlls\cryptsp.dll
                                module_tag: ''
                              - module_name: \KnownDlls\CRYPT32.dll
                                module_tag: ''
                              - module_name: \Sessions\1\Windows\SharedSection
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\seguisym.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\twinapi.appcore.dll
                                module_tag: ''
                              - module_name: \Sessions\1\Windows\Theme1501086290
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\resources.pak
                                module_tag: ''
                              - module_name: \KnownDlls\dhcpcsvc.DLL
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\chrome.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\BitsProxy.dll
                                module_tag: ''
                              - module_name: \KnownDlls\dxgi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WS2_32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\NSI.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\WinTypes.dll
                                module_tag: ''
                              - module_name: \KnownDlls\KBDUS.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\sechost.dll
                                module_tag: ''
                              - module_name: \KnownDlls\cfgmgr32.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\winmmbase.dll
                                module_tag: ''
                              - module_name: \KnownDlls\clbcatq.dll
                                module_tag: ''
                              - module_name: \KnownDlls\DSREG.DLL
                                module_tag: ''
                              - module_name: C:\Windows\System32\netutils.dll
                                module_tag: ''
                              - module_name: \KnownDlls\TextInputFramework.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\arialbd.ttf
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\icudtl.dat
                                module_tag: ''
                              - module_name: C:\Windows\System32\en-US\propsys.dll.mui
                                module_tag: ''
                              - module_name: \KnownDlls\ADVAPI32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WINTRUST.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\consolab.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\KERNELBASE.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WTSAPI32.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\winmm.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ole32.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\consolaz.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\mscms.dll
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\Locales\en-US.pak
                                module_tag: ''
                              - module_name: C:\Windows\System32\dwmapi.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\KBDUS.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\RMCLIENT.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dmcmnutils.dll
                                module_tag: ''
                              - module_name: \KnownDlls\bcrypt.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\FirewallAPI.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\verdanab.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\netutils.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\seguiemj.ttf
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\ARIALNBI.TTF
                                module_tag: ''
                              - module_name: C:\Windows\System32\dbghelp.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\netapi32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\PROPSYS.dll
                                module_tag: ''
                              - module_name: \KnownDlls\LINKINFO.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\DWrite.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Local\CTF.AsmListCache.FMPDefault1
                                module_tag: ''
                              - module_name: C:\Windows\System32\rmclient.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\ExplorerFrame.dll
                                module_tag: ''
                              - module_name: \KnownDlls\FLTLIB.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\BitsProxy.dll
                                module_tag: ''
                              - module_name: \KnownDlls\wintypes.dll
                                module_tag: ''
                              - module_name: \KnownDlls\mswsock.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\cryptsp.dll
                                module_tag: ''
                              - module_name: \KnownDlls\winmmbase.dll
                                module_tag: ''
                              - module_name: \KnownDlls\msvcrt.dll
                                module_tag: ''
                              - module_name: \KnownDlls\dcomp.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\imm32.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\wkscli.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*ProgramData*Microsoft*Windows*Caches*cversions.2
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\windows_shell_global_counters
                                module_tag: ''
                              - module_name: \KnownDlls\gpapi.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Global\__ComCatalogCache__
                                module_tag: ''
                              - module_name: \KnownDlls\FirewallAPI.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\Windows.Media.dll
                                module_tag: ''
                              - module_name: \KnownDlls\MDMRegistration.dll
                                module_tag: ''
                              - module_name: \KnownDlls\windows.storage.dll
                                module_tag: ''
                              - module_name: \KnownDlls\WINMMBASE.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\dxgi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\KERNEL32.DLL
                                module_tag: ''
                              - module_name: C:\Windows\System32\msacm32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\MSASN1.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\PCPKsp.dll
                                module_tag: ''
                              - module_name: \KnownDlls\powrprof.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\ARIALNI.TTF
                                module_tag: ''
                              - module_name: \KnownDlls\CRYPTSP.dll
                                module_tag: ''
                              - module_name: \KnownDlls\win32u.dll
                                module_tag: ''
                              - module_name: \KnownDlls\bcryptPrimitives.dll
                                module_tag: ''
                              - module_name: \KnownDlls\DEVOBJ.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\directmanipulation.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Global\windows_shell_global_counters
                                module_tag: ''
                              - module_name: C:\Windows\System32\IPHLPAPI.DLL
                                module_tag: ''
                              - module_name: \KnownDlls\dhcpcsvc6.DLL
                                module_tag: ''
                              - module_name: C:\Windows\System32\wpnapps.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*Users*user*AppData*Local*Microsoft*Windows*Caches*cversions.1
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Local\C:*Users*user*AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db
                                module_tag: ''
                              - module_name: C:\Windows\System32\bcrypt.dll
                                module_tag: ''
                              - module_name: \KnownDlls\OneCoreUAPCommonProxyStub.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\atlthunk.dll
                                module_tag: ''
                              - module_name: \KnownDlls\RTWorkQ.DLL
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\HWNDInterface:6035e
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\courbd.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\userenv.dll
                                module_tag: ''
                              - module_name: \KnownDlls\SHLWAPI.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\InputHost.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\Windows.UI.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ColorAdapterClient.dll
                                module_tag: ''
                              - module_name: \KnownDlls\RPCRT4.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\d3d11.dll
                                module_tag: ''
                              - module_name: \KnownDlls\ncryptprov.dll
                                module_tag: ''
                              - module_name: \KnownDlls\CoreMessaging.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\wlanapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\IMM32.DLL
                                module_tag: ''
                              - module_name: C:\Windows\Globalization\Sorting\SortDefault.nls
                                module_tag: ''
                              - module_name: \KnownDlls\atlthunk.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\sspicli.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\winspool.drv
                                module_tag: ''
                              - module_name: \KnownDlls\fwbase.dll
                                module_tag: ''
                              - module_name: C:\Windows\WindowsShell.Manifest
                                module_tag: ''
                              - module_name: C:\Windows\System32\DataExchange.dll
                                module_tag: ''
                              - module_name: \KnownDlls\OLEACC.dll
                                module_tag: ''
                              - module_name: C:\Program Files (x86)\Google\Chrome\Application\113.0.5672.93\chrome_elf.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\couri.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\DMCmnUtils.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\fwbase.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\timesbi.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\Speech\Common\sapi.dll
                                module_tag: ''
                              - module_name: \KnownDlls\IPHLPAPI.DLL
                                module_tag: ''
                              - module_name: C:\Windows\System32\ntasn1.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\rsaenh.dll
                                module_tag: ''
                              - module_name: C:\Windows\System32\oleaccrc.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\ARIALN.TTF
                                module_tag: ''
                              - module_name: \KnownDlls\netapi32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\directmanipulation.dll
                                module_tag: ''
                              - module_name: \KnownDlls\wkscli.dll
                                module_tag: ''
                              - module_name: \Sessions\1\BaseNamedObjects\Global\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\verdanaz.ttf
                                module_tag: ''
                              - module_name: C:\Windows\System32\OneCoreUAPCommonProxyStub.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\cambria.ttc
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\timesi.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\DPAPI.dll
                                module_tag: ''
                              - module_name: C:\Windows\Fonts\seguisli.ttf
                                module_tag: ''
                              - module_name: \KnownDlls\GDI32.dll
                                module_tag: ''
                              - module_name: \KnownDlls\NTASN1.dll
                                module_tag: ''
                        mitre_attack:
                          matrix_list:
                            - tactics:
                                tactic_list:
                                  - techniques:
                                      technique_list:
                                        - id: T1036
                                          name: Masquerading
                                        - id: T1055
                                          name: Process Injection
                                    name: Defense Evasion
                                    id: TA0003
                                  - techniques:
                                      technique_list:
                                        - id: T1046
                                          name: Network Service Scanning
                                    name: Discovery
                                    id: TA0005
                                  - techniques:
                                      technique_list: []
                                    name: Privilege Escalation
                                    id: TA0002
                                  - techniques:
                                      technique_list: []
                                    name: Credential Access
                                    id: TA0004
                                  - techniques:
                                      technique_list:
                                        - id: T1071
                                          name: Application Layer Protocol
                                        - id: T1095
                                          name: Non-Application Layer Protocol
                                        - id: T1105
                                          name: Ingress Tool Transfer
                                        - id: T1573
                                          name: Encrypted Channel
                                    name: Command and Control
                                    id: TA0009
                                  - techniques:
                                      technique_list:
                                        - id: T1189
                                          name: Drive-by Compromise
                                    name: Initial Access
                                    id: TA0043
                              name: Enterprise
                      private_data_filtered: false
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - report
                      - requested_sha1_url
                      - private_data_filtered
                      - requested_id
                    properties:
                      requested_sha1_url:
                        type: string
                        format: sha1
                      requested_id:
                        type: string
                        format: uuid
                      report:
                        type: object
                        properties:
                          md5:
                            type: string
                            format: md5
                          sha1:
                            type: string
                            format: sha1
                          sha256:
                            type: string
                            format: sha256
                          url:
                            type: string
                            format: url
                          url_base64:
                            type: string
                            format: base64
                          risk_score:
                            type: number
                            minimum: 0
                            maximum: 10
                            description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                          classification:
                            type: string
                            description: The classification of the sample.
                            enum:
                              - MALICIOUS
                              - SUSPICIOUS
                              - KNOWN
                              - UNKNOWN
                          interactive:
                            type: string
                            description: |
                              Whether this report is the result of an interactive session
                              from Spectra Analyze.
                            enum:
                              - 'true'
                              - 'false'
                          timeout:
                            type: number
                            description: The maximum configured time the sample was allowed to run on the VM.
                          analysis_id:
                            type: string
                            format: uuid
                          analysis_time:
                            type: string
                            format: date-time
                          analysis_duration:
                            type: number
                          browser:
                            type: string
                          configuration:
                            type: string
                            description: Sandbox configuration (installed software).
                          process_tree:
                            type: array
                            description: An entire process tree generated during sample execution, sorted in order.
                            items:
                              type: object
                              properties:
                                name:
                                  type: string
                                  example: WINWORD.EXE
                                parameters:
                                  type: string
                                process_id:
                                  type: number
                                parent_process_id:
                                  type: number
                          screenshots_data:
                            description: List of screenshots taken during execution.
                            type: array
                            items:
                              type: object
                          pcap:
                            type: string
                            format: url
                          memory_strings:
                            type: string
                            format: url
                          screenshots:
                            type: string
                            format: url
                          dropped_files_url:
                            type: string
                            format: url
                          behavioral:
                            type: array
                            items:
                              type: object
                          signatures:
                            type: array
                            items:
                              type: object
                              properties:
                                sig_id:
                                  type: string
                                description:
                                  type: string
                                risk_factor:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                          threat_names:
                            type: array
                            items:
                              type: object
                              properties:
                                threat_name:
                                  type: string
                          yara:
                            type: object
                          suricata_alerts:
                            type: array
                            items:
                              type: object
                          bot_configurations:
                            type: array
                            items:
                              type: object
                      private_data_filtered:
                        $ref: '#/components/schemas/private_data_filtered'
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/url/sha1/171ba7127cf28cc63ea1fef74be9746842f5093f/latest' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/dynamic/analysis/report/v1/query/url/sha1/171ba7127cf28cc63ea1fef74be9746842f5093f/latest"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/dynamic/analysis/report/v1/archive/query/{hash_type}/{hash_value}:
    get:
      summary: 'TCA-0106: Dynamic Analysis Report (archives) (merged report)'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: get-api-dynamic-analysis-report-v1-archive-query-hash_type-hash_value
      parameters:
        - name: hash_type
          in: path
          required: true
          schema:
            type: string
            enum:
              - sha1
          description: 'Required parameter. Specifies which hash type will be used in the request. Supported values: **sha1**.'
        - $ref: '#/components/parameters/HashValue'
        - $ref: '#/components/parameters/ResponseFormat'
      description: The Dynamic Analysis Report service allows users to retrieve dynamic analysis reports for files executed in the cloud sandbox. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_hash: 81010584cf702fee38b9f5689845acca8ad7d400
                      files:
                        - sha1: bbc11692c14cb63f10fee704e06ff2e4e18f2d87
                          merged_report:
                            platforms:
                              - windows10
                              - windows7
                            classification: MALICIOUS
                            first_analysis: '2023-04-27T09:20:00'
                            last_analysis: '2023-05-25T08:34:27'
                            history_analysis:
                              - analysis_id: 9a8ae0c1-e3c8-4062-b038-c461210e2e9d
                                analysis_time: '2023-04-27T09:20:00'
                                classification: MALICIOUS
                                platform: windows10
                                configuration: MS Office 2007;Java 8;Adobe Reader 2020;Firefox 62;Google Chrome 69;Microsoft Edge 42;Internet Explorer 11
                                optional_parameters: internet_simulation=true
                                risk_score: 8
                                analysis_duration: 212
                              - analysis_id: a599d448-24a5-4cf3-87c4-98d651671386
                                analysis_time: '2023-05-25T08:34:27'
                                classification: MALICIOUS
                                platform: windows7
                                configuration: MS Office 2007;Java 7;Adobe reader 8;Firefox 37;Google Chrome 51;Internet Explorer 8
                                optional_parameters: internet_simulation=true
                                risk_score: 10
                                analysis_duration: 215
                            risk_score: 10
                            mitre_attack:
                              matrix_list:
                                - name: Enterprise
                                  tactics:
                                    tactic_list:
                                      - id: TA0003
                                        name: Defense Evasion
                                        techniques:
                                          technique_list:
                                            - id: T1027.002
                                              name: Software Packing
                                              analysis_ids:
                                                - 9a8ae0c1-e3c8-4062-b038-c461210e2e9d
                                                - a599d448-24a5-4cf3-87c4-98d651671386
                                            - id: T1027
                                              name: Obfuscated Files or Information
                                              analysis_ids:
                                                - 9a8ae0c1-e3c8-4062-b038-c461210e2e9d
                                                - a599d448-24a5-4cf3-87c4-98d651671386
                                            - id: T1562.001
                                              name: Disable or Modify Tools
                                              analysis_ids:
                                                - a599d448-24a5-4cf3-87c4-98d651671386
                                      - id: TA0005
                                        name: Discovery
                                        techniques:
                                          technique_list:
                                            - id: T1082
                                              name: System Information Discovery
                                              analysis_ids:
                                                - a599d448-24a5-4cf3-87c4-98d651671386
                                            - id: T1518.001
                                              name: Security Software Discovery
                                              analysis_ids:
                                                - a599d448-24a5-4cf3-87c4-98d651671386
                            behavioral:
                              - process:
                                  name: rl_file.exe
                                  parameters: C:\Users\user\Desktop\rl_file.exe
                                  analysis_ids:
                                    - a599d448-24a5-4cf3-87c4-98d651671386
                                mutex_actions:
                                  - name: unknown
                                    action_type: mutex_created
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                file_actions:
                                  - file_path: C:\Windows\assembly\NativeImages_v4.0.30319_64
                                    file_name: mscorlib
                                    action_type: file_opened
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                  - file_path: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\dcbadb02f6000b436f1cb0fb736df3ee
                                    file_name: System.Drawing.ni.dll.aux
                                    action_type: file_opened
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                  - file_path: ''
                                    file_name: 'C:'
                                    action_type: file_opened
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                  - file_path: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9
                                    file_name: comctl32.dll
                                    action_type: file_opened
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                  - file_path: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\cb8c46fb93cee393acd4db95f6d8bfa2
                                    file_name: System.Windows.Forms.ni.dll
                                    action_type: file_opened
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                  - file_path: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\8821b72d5d51079acf96e90c4af19a96
                                    file_name: System.Xml.ni.dll.aux
                                    action_type: file_opened
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                  - file_path: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac
                                    file_name: comctl32.dll
                                    action_type: file_opened
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                  - file_path: C:\Users\user\AppData
                                    file_name: Roaming
                                    action_type: file_created
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: object name collision
                                  - file_path: C:\Windows\system32
                                    file_name: rpcss.dll
                                    action_type: file_opened
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                  - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
                                    action_type: key_value_queried
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                    value: ''
                                process_actions:
                                  - path: C:\Users\user\Desktop\rl_file.exe
                                    action_type: process_queried
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                    status: success or wait
                                modules_loaded:
                                  - module_name: \KnownDlls\USP10.dll
                                    module_tag: ''
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                  - module_name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll
                                    module_tag: ''
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                  - module_name: \KnownDlls\profapi.dll
                                    module_tag: ''
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                  - module_name: \KnownDlls\USER32.dll
                                    module_tag: ''
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                                  - module_name: \KnownDlls\GDI32.dll
                                    module_tag: ''
                                    analysis_ids:
                                      - a599d448-24a5-4cf3-87c4-98d651671386
                            network:
                              url:
                                - url: https://www.sysinternals.com0
                                  source: memory
                                  analysis_ids:
                                    - a599d448-24a5-4cf3-87c4-98d651671386
                            signatures:
                              - sig_id: 521
                                description: PE file has a big raw section
                                risk_factor: 0
                                analysis_ids:
                                  - 9a8ae0c1-e3c8-4062-b038-c461210e2e9d
                                  - a599d448-24a5-4cf3-87c4-98d651671386
                              - sig_id: 1753
                                description: .NET source code contains potential unpacker
                                risk_factor: 8
                                analysis_ids:
                                  - 9a8ae0c1-e3c8-4062-b038-c461210e2e9d
                                  - a599d448-24a5-4cf3-87c4-98d651671386
                              - sig_id: 1248
                                description: Binary contains paths to debug symbols
                                risk_factor: 0
                                analysis_ids:
                                  - 9a8ae0c1-e3c8-4062-b038-c461210e2e9d
                                  - a599d448-24a5-4cf3-87c4-98d651671386
                              - sig_id: 357
                                description: URLs found in memory or binary data
                                risk_factor: 5
                                analysis_ids:
                                  - a599d448-24a5-4cf3-87c4-98d651671386
                              - sig_id: 367
                                description: Tries to detect sandboxes and other dynamic analysis tools
                                risk_factor: 8
                                analysis_ids:
                                  - a599d448-24a5-4cf3-87c4-98d651671386
                              - sig_id: 1460
                                description: Reads software policies
                                risk_factor: 5
                                analysis_ids:
                                  - a599d448-24a5-4cf3-87c4-98d651671386
                              - sig_id: 1199
                                description: Program does not show much activity (idle)
                                risk_factor: 7
                                analysis_ids:
                                  - a599d448-24a5-4cf3-87c4-98d651671386
                            threat_names:
                              - threat_name: Unknown
                                analysis_ids:
                                  - 9a8ae0c1-e3c8-4062-b038-c461210e2e9d
                                  - a599d448-24a5-4cf3-87c4-98d651671386
                            md5: fe4b4c4b402141fd4190e74a93386dab
                            sha256: 7d847ab014e8d081ed276708cd7e2c136cbb31474077b6a81b174886952cc51f
                            sha1: bbc11692c14cb63f10fee704e06ff2e4e18f2d87
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      requested_hash:
                        type: string
                      files:
                        type: array
                        items:
                          type: object
                          properties:
                            sha1:
                              type: string
                            merged_report:
                              type: object
                              properties:
                                md5:
                                  type: string
                                  format: md5
                                sha1:
                                  type: string
                                  format: sha1
                                sha256:
                                  type: string
                                  format: sha256
                                url:
                                  type: string
                                  format: url
                                url_base64:
                                  type: string
                                  format: base64
                                risk_score:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                                  description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                                classification:
                                  type: string
                                  description: The classification of the sample.
                                  enum:
                                    - MALICIOUS
                                    - SUSPICIOUS
                                    - KNOWN
                                    - UNKNOWN
                                interactive:
                                  type: string
                                  description: |
                                    Whether this report is the result of an interactive session
                                    from Spectra Analyze.
                                  enum:
                                    - 'true'
                                    - 'false'
                                timeout:
                                  type: number
                                  description: The maximum configured time the sample was allowed to run on the VM.
                                classification_version:
                                  type: number
                                first_analysis:
                                  type: string
                                  format: date-time
                                last_analysis:
                                  type: string
                                  format: date-time
                                history_analysis:
                                  type: array
                                  description: An object containing an overview of all available reports.
                                  items:
                                    type: object
                                    properties:
                                      analysis_id:
                                        type: string
                                        description: The analysis ID of the report.
                                      analysis_time:
                                        type: string
                                        description: The date and time of the analysis.
                                        format: date-time
                                      classification:
                                        type: string
                                        description: The classification of the sample.
                                        enum:
                                          - MALICIOUS
                                          - SUSPICIOUS
                                          - KNOWN
                                          - UNKNOWN
                                      platform:
                                        type: string
                                        description: The platform used to analyze the sample.
                                      configuration:
                                        type: string
                                        description: A short description of the platform configuration specifics (for example, "Win10 x64, Office 2016, Java 8 Update 191").
                                      optional_parameters:
                                        type: string
                                        enum:
                                          - internet_simulation=true
                                          - internet_simulation=false
                                        example: internet_simulation=false
                                      risk_score:
                                        type: number
                                        minimum: 0
                                        maximum: 10
                                        description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                                      classification_version:
                                        type: number
                                      browser:
                                        type: string
                                        description: Browser used in the sandbox.
                                      sample_name:
                                        type: string
                                        description: Custom file name and/or extension provided on submission. Custom extensions impact which application was used to open and run the file.
                                      geolocation:
                                        type: string
                                        description: Geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods.
                                        default: us
                                        enum:
                                          - us
                                          - uk
                                          - in
                                          - br
                                          - de
                                          - jp
                                          - sg
                                          - it
                                          - es
                                          - fr
                                          - tor
                                      locale:
                                        type: string
                                        description: The configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes.
                                        default: en-US
                                        enum:
                                          - en-US
                                          - en-GB
                                          - pt-BR
                                          - de-DE
                                          - ja-JP
                                          - it-IT
                                          - es-ES
                                          - fr-FR
                                      analysis_duration:
                                        type: number
                                        description: The duration of the analysis (in seconds).
                                      warnings:
                                        type: array
                                        items:
                                          type: string
                                      errors:
                                        type: array
                                        items:
                                          type: string
                                      pcap:
                                        type: string
                                        format: url
                                      memory_strings:
                                        type: string
                                        format: url
                                      screenshots:
                                        type: string
                                        format: url
                                      dropped_files:
                                        type: string
                                        format: url
                                platforms:
                                  type: array
                                  description: Platforms used to analyze the sample.
                                  items:
                                    type: string
                                    enum:
                                      - windows7
                                      - windows10
                                      - macos11
                                behavioral:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      analysis_ids:
                                        type: array
                                        items:
                                          type: string
                                          format: uuid
                                signatures:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      analysis_ids:
                                        type: array
                                        items:
                                          type: string
                                          format: uuid
                                      sig_id:
                                        type: string
                                      description:
                                        type: string
                                      risk_factor:
                                        type: number
                                        minimum: 0
                                        maximum: 10
                                    required:
                                      - analysis_ids
                                threat_names:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      analysis_ids:
                                        type: array
                                        items:
                                          type: string
                                          format: uuid
                                      threat_name:
                                        type: string
                                    required:
                                      - analysis_ids
                                yara:
                                  type: object
                                  properties:
                                    entries:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          analysis_ids:
                                            type: array
                                            items:
                                              type: string
                                              format: uuid
                                        required:
                                          - analysis_ids
                                suricata_alerts:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      analysis_ids:
                                        type: array
                                        items:
                                          type: string
                                          format: uuid
                                    required:
                                      - analysis_ids
                                bot_configurations:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      analysis_ids:
                                        type: array
                                        items:
                                          type: string
                                          format: uuid
                                    required:
                                      - analysis_ids
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The server has not found anything matching the Request URI. / Analysis Failed.
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/dynamic/analysis/report/v1/archive/query/sha1/54bdccd42f89242ba21fd1a48fcb438a2a2c1829?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/dynamic/analysis/report/v1/archive/query/sha1/54bdccd42f89242ba21fd1a48fcb438a2a2c1829?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/dynamic/analysis/report/v1/archive/query/{hash_type}/{hash_value}/latest:
    get:
      summary: 'TCA-0106: Dynamic Analysis Report (archives) (latest)'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: get-api-dynamic-analysis-report-v1-archive-query-hash_type-hash_value-latest
      parameters:
        - name: hash_type
          in: path
          required: true
          schema:
            type: string
            enum:
              - sha1
          description: 'Required parameter. Specifies which hash type will be used in the request. Supported values: **sha1**.'
        - $ref: '#/components/parameters/HashValue'
        - $ref: '#/components/parameters/ResponseFormat'
      description: The Dynamic Analysis Report service allows users to retrieve dynamic analysis reports for files executed in the cloud sandbox. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_hash: 81010584cf702fee38b9f5689845acca8ad7d400
                      files:
                        - sha1: bbc11692c14cb63f10fee704e06ff2e4e18f2d87
                          report:
                            analysis_id: a599d448-24a5-4cf3-87c4-98d651671386
                            md5: fe4b4c4b402141fd4190e74a93386dab
                            sha1: bbc11692c14cb63f10fee704e06ff2e4e18f2d87
                            sha256: 7d847ab014e8d081ed276708cd7e2c136cbb31474077b6a81b174886952cc51f
                            analysis_time: '2023-05-25T08:34:27'
                            classification: MALICIOUS
                            risk_score: 100
                            platform: windows7
                            configuration: MS Office 2007;Java 7;Adobe reader 8;Firefox 37;Google Chrome 51;Internet Explorer 8
                            optional_parameters: internet_simulation=true
                            process_tree:
                              - name: rl_file.exe
                                parameters: C:\Users\user\Desktop\rl_file.exe
                                process_id: 2292
                                parent_process_id: 2040
                            analysis_duration: 215
                            threat_names:
                              - threat_name: Unknown
                            signatures:
                              - sig_id: 521
                                risk_factor: 0
                                description: PE file has a big raw section
                              - sig_id: 1753
                                risk_factor: 8
                                description: .NET source code contains potential unpacker
                              - sig_id: 1248
                                risk_factor: 0
                                description: Binary contains paths to debug symbols
                              - sig_id: 362
                                risk_factor: 10
                                description: Multi AV Scanner detection for submitted file
                              - sig_id: 2086
                                risk_factor: 8
                                description: .NET source code contains very large strings
                              - sig_id: 530
                                risk_factor: 7
                                description: PE file does not import any functions
                              - sig_id: 1532
                                risk_factor: 5
                                description: Sample is known by Antivirus (Virustotal or Metascan)
                              - sig_id: 528
                                risk_factor: 0
                                description: Submission file is bigger than most known malware samples
                              - sig_id: 420
                                risk_factor: 5
                                description: Classification label
                              - sig_id: 517
                                risk_factor: 0
                                description: Contains modern PE file flags such as dynamic base (ASLR) or NX
                              - sig_id: 523
                                risk_factor: 0
                                description: PE file contains a debug data directory
                              - sig_id: 524
                                risk_factor: 0
                                description: PE file contains a COM descriptor data directory
                              - sig_id: 1855
                                risk_factor: 5
                                description: Internet has been disabled. Sample is run without having any access to the Internet
                              - sig_id: 394
                                risk_factor: 7
                                description: Sample file is different than original file name gathered from version info
                              - sig_id: 1721
                                risk_factor: 5
                                description: .NET source code contains long base64-encoded strings
                            network:
                              url:
                                - url: https://www.sysinternals.com0
                                  source: memory
                            behavioral:
                              - process:
                                  name: rl_file.exe
                                  parameters: C:\Users\user\Desktop\rl_file.exe
                                mutex_actions:
                                  - name: unknown
                                    action_type: mutex_created
                                    status: success or wait
                                file_actions:
                                  - file_path: C:\Windows\assembly\NativeImages_v4.0.30319_64
                                    file_name: mscorlib
                                    status: success or wait
                                    action_type: file_opened
                                  - file_path: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\dcbadb02f6000b436f1cb0fb736df3ee
                                    file_name: System.Drawing.ni.dll.aux
                                    status: success or wait
                                    action_type: file_opened
                                  - file_path: ''
                                    file_name: 'C:'
                                    status: success or wait
                                    action_type: file_opened
                                  - file_path: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9
                                    file_name: comctl32.dll
                                    status: success or wait
                                    action_type: file_opened
                                  - file_path: C:\Users
                                    file_name: user
                                    status: success or wait
                                    action_type: file_opened
                                  - key_name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
                                    status: object name not found
                                    value: ''
                                    action_type: key_opened
                                process_actions:
                                  - path: C:\Users\user\Desktop\rl_file.exe
                                    status: success or wait
                                    action_type: process_queried
                                modules_loaded:
                                  - module_name: \KnownDlls\USP10.dll
                                    module_tag: ''
                                  - module_name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll
                                    module_tag: ''
                                  - module_name: \KnownDlls\profapi.dll
                                    module_tag: ''
                                  - module_name: \KnownDlls\USER32.dll
                                    module_tag: ''
                                  - module_name: \KnownDlls\VERSION.dll
                                    module_tag: ''
                                  - module_name: C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll
                                    module_tag: ''
                                  - module_name: \KnownDlls\CRYPTSP.dll
                                    module_tag: ''
                                  - module_name: C:\Windows\Globalization\Sorting\SortDefault.nls
                                    module_tag: ''
                                  - module_name: \Sessions\1\BaseNamedObjects\windows_shell_global_counters
                                    module_tag: ''
                                  - module_name: \KnownDlls\CRYPTBASE.dll
                                    module_tag: ''
                                  - module_name: \KnownDlls\RPCRT4.dll
                                    module_tag: ''
                                  - module_name: C:\Windows\System32\cryptbase.dll
                                    module_tag: ''
                                  - module_name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sortdefault.nlp
                                    module_tag: ''
                                  - module_name: C:\Windows\System32\rsaenh.dll
                                    module_tag: ''
                                  - module_name: \KnownDlls\KERNEL32.dll
                                    module_tag: ''
                                  - module_name: C:\Windows\System32\msvcr120_clr0400.dll
                                    module_tag: ''
                                  - module_name: \KnownDlls\ADVAPI32.dll
                                    module_tag: ''
                                  - module_name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll
                                    module_tag: ''
                                  - module_name: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
                                    module_tag: ''
                                  - module_name: \KnownDlls\KERNELBASE.dll
                                    module_tag: ''
                                  - module_name: \KnownDlls\ole32.dll
                                    module_tag: ''
                            mitre_attack:
                              matrix_list:
                                - tactics:
                                    tactic_list:
                                      - techniques:
                                          technique_list:
                                            - id: T1027.002
                                              name: Software Packing
                                            - id: T1027
                                              name: Obfuscated Files or Information
                                            - id: T1562.001
                                              name: Disable or Modify Tools
                                        name: Defense Evasion
                                        id: TA0003
                                      - techniques:
                                          technique_list:
                                            - id: T1082
                                              name: System Information Discovery
                                            - id: T1518.001
                                              name: Security Software Discovery
                                        name: Discovery
                                        id: TA0005
                                  name: Enterprise
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      requested_hash:
                        type: string
                      files:
                        type: array
                        items:
                          type: object
                          properties:
                            sha1:
                              type: string
                            report:
                              type: object
                              properties:
                                md5:
                                  type: string
                                  format: md5
                                sha1:
                                  type: string
                                  format: sha1
                                sha256:
                                  type: string
                                  format: sha256
                                url:
                                  type: string
                                  format: url
                                url_base64:
                                  type: string
                                  format: base64
                                risk_score:
                                  type: number
                                  minimum: 0
                                  maximum: 10
                                  description: A sample's [risk score](/General/AnalysisAndClassification/Classification/#risk-score).
                                classification:
                                  type: string
                                  description: The classification of the sample.
                                  enum:
                                    - MALICIOUS
                                    - SUSPICIOUS
                                    - KNOWN
                                    - UNKNOWN
                                interactive:
                                  type: string
                                  description: |
                                    Whether this report is the result of an interactive session
                                    from Spectra Analyze.
                                  enum:
                                    - 'true'
                                    - 'false'
                                timeout:
                                  type: number
                                  description: The maximum configured time the sample was allowed to run on the VM.
                                analysis_id:
                                  type: string
                                  format: uuid
                                analysis_time:
                                  type: string
                                  format: date-time
                                analysis_duration:
                                  type: number
                                browser:
                                  type: string
                                configuration:
                                  type: string
                                  description: Sandbox configuration (installed software).
                                process_tree:
                                  type: array
                                  description: An entire process tree generated during sample execution, sorted in order.
                                  items:
                                    type: object
                                screenshots_data:
                                  description: List of screenshots taken during execution.
                                  type: array
                                  items:
                                    type: object
                                pcap:
                                  type: string
                                  format: url
                                memory_strings:
                                  type: string
                                  format: url
                                screenshots:
                                  type: string
                                  format: url
                                dropped_files_url:
                                  type: string
                                  format: url
                                behavioral:
                                  type: array
                                  items:
                                    type: object
                                signatures:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      sig_id:
                                        type: string
                                      description:
                                        type: string
                                      risk_factor:
                                        type: number
                                        minimum: 0
                                        maximum: 10
                                threat_names:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      threat_name:
                                        type: string
                                yara:
                                  type: object
                                suricata_alerts:
                                  type: array
                                  items:
                                    type: object
                                bot_configurations:
                                  type: array
                                  items:
                                    type: object
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The server has not found anything matching the Request URI. / Analysis Failed.
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/dynamic/analysis/report/v1/archive/query/sha1/54bdccd42f89242ba21fd1a48fcb438a2a2c1829/latest?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/dynamic/analysis/report/v1/archive/query/sha1/54bdccd42f89242ba21fd1a48fcb438a2a2c1829"
            querystring = {"format":"json"}
            response = requests.get(url, querystring, auth=('username', 'password'))
            print(response.text)
    parameters:
      - schema:
          type: string
        name: hash_type
        in: path
        required: true
      - schema:
          type: string
        name: hash_value
        in: path
        required: true
  /api/spex/download/v2/query/{hash_type}/{hash_value}:
    servers:
      - url: https://data.reversinglabs.com
    get:
      summary: 'TCA-0201: File Download Request'
      tags:
        - Automation
      operationId: get-api-spex-download-v2-query
      parameters:
        - $ref: '#/components/parameters/HashType'
        - $ref: '#/components/parameters/HashValue'
      description: 'The External Sample Exchange Service allows users to download files from ReversingLabs Spectra Intelligence. This query returns the contents of a file matching the requested hash. The contents are returned as a byte stream. Only one file can be downloaded per request. '
      responses:
        '200':
          description: The request has succeeded. The file contents are returned as a byte stream.
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: The sample is private and therefore not available for download. You can use the [TCA-0206 Alert on Reputation and Metadata](../Automation/tca-0206) API to get the notification when the sample becomes available. This error can also occur when the account doesn't have the necessary access rights. If this error persists, contact ReversingLabs support.
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: Can't complete the request. Try to resume upload.
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/spex/download/v2/query/sha1/a45ab18fb7a06dd5ecb44bf6c221a951f974059f' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/spex/download/v2/query/sha1/932572b25bfee2cab6e79b3237f106695caded02"

            response = requests.get(url, auth=('username', 'password'))

            print(response.text)
  /api/spex/download/v2/status/bulk_query/{post_format}:
    servers:
      - url: https://data.reversinglabs.com
    post:
      summary: 'TCA-0201: File Download Status Request'
      tags:
        - Automation
      operationId: post-api-spex-download-v2-status
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The External Sample Exchange Service allows users to download files from ReversingLabs Spectra Intelligence. This query returns the file size of samples matching the requested hash values, but only if they are available for download. If the requested samples are not available for download, their size is represented as `-1` in the response. Up to 1000 hashes can be submitted in one download status request. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      unknown_hashes:
                        - ca03064987d3c4465f91552ba8b6a883eecfd3e5
                      entries:
                        - sha1: b363713a938afcd3c74603827fab79e935b2b09b
                          size: 6
                        - sha1: a7afddb68260a60f86c02a021efba7f216c2e7cf
                          size: 4
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      unknown_hashes:
                        type: array
                        items:
                          type: string
                      invalid_hashes:
                        type: array
                        items:
                          type: string
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            sha1:
                              type: string
                            size:
                              type: integer
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: Forbidden. The server understood the request, but is refusing to fulfill it. The reason may be because the user is not authorized to make requests to this API / The sample is not available for download at this time. You can use the RL Alerting API (TCA-0206 Alert on Reputation and Metadata) to get the notification when the sample becomes available for download
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl -X POST --url 'https://data.reversinglabs.com/api/spex/download/v2/status/bulk_query/json' --header 'Content-Type: application/json' --data '{
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b"
                  ]
                }
              }
            }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/spex/download/v2/status/bulk_query/json?format=json"

            json = {
                "rl": {
                    "query": {
                        "hash_type": "sha1",
                        "hashes": [
                            "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                            "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                            "b363713a938afcd3c74603827fab79e935b2b09b",
                            "example_of_a_wrong_hash"
                        ]
                    }
                }
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
  /api/spex/upload/{hash_value}:
    post:
      summary: 'TCA-0202/0203: File Upload Request'
      tags:
        - Automation
      operationId: post-api-spex-upload
      parameters:
        - name: hash_value
          in: path
          schema:
            type: string
          description: Must be a valid SHA1 hash of the uploaded file.
          required: true
      description: |-
        The External Sample Exchange Service allows users to upload files to Spectra Intelligence. This query uploads the file contents using a byte stream and the SHA1 hash of the file provided in the request. **The file metadata must be uploaded after the file contents in a separate request for file processing to occur.** Depending on the user's Spectra Intelligence account configuration, files are uploaded as public (sent to TCA-0202), or private (sent to TCA-0203).
         
      responses:
        '200':
          description: The request has succeeded.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          description: Request Too Large. The request contained more than the maximum allowed amount of hashes (100).
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST 'https://data.reversinglabs.com/api/spex/upload/3715b867a6ce91aec3ce21d3703c68f80cf1cbc6' --data-binary @example_file.tar.gz --user <username>:<password>
        - lang: Python
          source: |
            import requests

            # Replace with the SHA1 hash and path of your file
            sha1 = 'fd4a554cfa71dbc31ef8ccca26851e0766f7c5af'

            url = f"https://data.reversinglabs.com/api/spex/upload/{sha1}"


            response = requests.post(url, auth=('username', 'password'))
            print(response.text)
      requestBody:
        required: true
        content:
          application/octet-stream:
            schema:
              type: string
              format: binary
  /api/spex/upload/{hash_value}/meta:
    post:
      summary: 'TCA-0202/0203: File Metadata Upload Request'
      tags:
        - Automation
      operationId: post-api-spex-upload-metadata
      parameters:
        - name: hash_value
          in: path
          schema:
            type: string
          description: Must be a valid SHA1 hash of a previously uploaded file.
          required: true
        - name: subscribe
          in: query
          schema:
            type: string
            enum:
              - data_change
          description: Optional parameter. If set, adds the file to the user's **data_change** feed subscription list.
      description: The External Sample Exchange Service allows users to upload files from ReversingLabs Spectra Intelligence. This query uploads the metadata of the file that matches the SHA1 hash provided in the request. Metadata must be provided in the XML format. **The file metadata must be uploaded after the file contents in a separate request for file processing to occur.** Depending on the user's Spectra Intelligence account configuration, files are uploaded as public (sent to TCA-0202), or private (sent to TCA-0203).
      responses:
        '200':
          description: The request has succeeded.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          description: Request Too Large. The request contained more than the maximum allowed amount of hashes (100).
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST 'https://data.reversinglabs.com/api/spex/upload/3715b867a6ce91aec3ce21d3703c68f80cf1cbc6/meta' -H "Content-Type: application/octet-stream" --data '<rl><properties><property><name>foo</name><value>bar</value></property></properties><domain>example.com</domain></rl>' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            # Replace with the SHA1 hash and path of your file
            sha1 = 'fd4a554cfa71dbc31ef8ccca26851e0766f7c5af'

            url = f"https://data.reversinglabs.com/api/spex/upload/{sha1}/meta"

            payload = """<?xml version="1.0" encoding="UTF-8"?>
             <rl>
               <properties>
                 <property>
                   <name>source</name>
                   <value>analyst</value>
                 </property>
                 <property>
                   <name>file_name</name>
                   <value>example_file.tar.gz</value>
                 </property>
                 <property>
                   <name>tags</name>
                   <value>application, utilities</value>
                 </property>
               </properties>
               <domain>example.com</domain>
             </rl>"""

            headers = {
                'Content-Type': 'application/octet-stream'
            }

            response = requests.post(url, data=payload, headers=headers, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/octet-stream:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    property:
                      type: object
                      properties:
                        name:
                          type: string
                        value:
                          type: string
                    domain:
                      type: string
                    archive:
                      type: object
                      properties:
                        type:
                          type: string
                          enum:
                            - zip
                        passwords:
                          type: array
                          items:
                            type: string
                      required:
                        - type
                  required:
                    - property
                    - domain
            examples:
              XML Request Example:
                summary: Example XML Request
                value: |
                  <rl>
                    <properties>
                      <property>
                        <name>application</name>
                        <value>TestApplication</value>
                      </property>
                      <property>
                        <name>author</name>
                        <value>Test_Author</value>
                      </property>
                    </properties>
                    <domain>testdomain.com</domain>
                    <archive>
                      <archive_passwords>
                        <password>password123</password>
                      </archive_passwords>
                    </archive>
                  </rl>
        description: |-
          Metadata must be provided in the XML format, while the request for the metadata must be sent using the `Content-Type: application/octet-stream` header.
          Metadata must contain the `domain` field and at least one `property` field.
          The domain name should represent the web domain where the sample was found/downloaded. If the domain name is not known, the domain name should be set to an empty string.
          The `property_name` and `property_value` can be any kind of string. They can represent some properties of the sample, such as its application name, version, file name of the sample, or tags.
          If the submission is an archive using a custom password, the password must be included in the `archive_passwords` object of the metadata upload request. If the archive uses one of the standard passwords (`infected`, `password`, `1234`), the password does not need to be specified.
  /api/delete/sample/v1/query/{hash_type}/{hash_value}:
    delete:
      summary: 'TCA-0204: Delete File Single Query'
      tags:
        - Automation
      operationId: delete-api-delete-sample-v1-query-hash_type-hash_value
      parameters:
        - $ref: '#/components/parameters/HashType'
        - $ref: '#/components/parameters/HashValue'
        - $ref: '#/components/parameters/ResponseFormat'
        - name: delete_on
          in: query
          schema:
            type: string
            example: 1437464369
          description: Optional parameter that specifies when the file will be deleted, allowing users to schedule file removal for a specific time. Expressed as a Unix timestamp in seconds.
      description: 'The Delete File API provides the functionality of deleting files submitted and owned exclusively by the user sending the request. This query allows the user to delete a single file. '
      responses:
        '200':
          description: The request has succeeded. Response code 200 is returned when the file is successfully deleted.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request DELETE --url 'https://data.reversinglabs.com/api/delete/sample/v1/query/sha1/bc7a6c7bba614456412fcd11d870f207be1bf6a5' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/delete/sample/v1/query/sha1/bc7a6c7bba614456412fcd11d870f207be1bf6a5?format=json"

            payload="<file contents here>"

            headers = {
              'Content-Type': 'application/json'
            }

            response = requests.delete(url, headers=headers, data=payload, auth=('username', 'password'))

            print(response.text)
  /api/spex/delete/sample/v1/bulk_query/{post_format}:
    delete:
      summary: 'TCA-0204: Delete File Bulk Query'
      tags:
        - Automation
      operationId: delete-api-spex-delete-sample-v1-bulk_query-post_format
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - $ref: '#/components/parameters/ResponseBulk'
      description: 'The Delete File API provides the functionality of deleting files submitted and owned exclusively by the user sending the request. Up to 100 hashes can be submitted in one request. '
      responses:
        '200':
          description: The request has succeeded. Response code 200 is returned when the file is successfully deleted.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      forbidden_hashes:
                        - b363713a938afcd3c74603827fab79e935b2b09b
                        - a7afddb68260a60f86c02a021efba7f216c2e7cf
                      unknown_hashes:
                        - ca03064987d3c4465f91552ba8b6a883eecfd3e5
                      invalid_hashes:
                        - example_of_a_wrong_hash
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      forbidden_hashes:
                        type: array
                        items:
                          type: string
                      unknown_hashes:
                        type: array
                        items:
                          type: string
                      invalid_hashes:
                        type: array
                        items:
                          type: string
                      deleted_hashes:
                        type: array
                        items:
                          type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request DELETE --url 'https://data.reversinglabs.com/api/delete/sample/v1/bulk_query/json' --data '{
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "3715b867a6ce91aec3ce21d3703c68f80cf1cbc6"
                  ]
                }
              }
            }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/delete/sample/v1/bulk_query/json"

            json = {
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b",
                    "example_of_a_wrong_hash"
                  ]
                }
              }
            }

            response = requests.delete(url, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        $ref: '#/components/requestBodies/BulkRequest'
  /api/rescan/v1/query/{hash_type}/{hash_value}:
    get:
      summary: 'TCA-0205: Re-Analyze File Single Query'
      tags:
        - Automation
      operationId: get-api-rescan-v1-query
      parameters:
        - $ref: '#/components/parameters/HashType'
        - $ref: '#/components/parameters/HashValue'
      description: 'The Rescan API allows users to submit files for re-analysis in the ReversingLabs Spectra Intelligence system. Re-analysis includes all components of the ReversingLabs Classification Algorithm: Spectra Intelligence antivirus scan results, threat and trust factors, parent/child relationships, certificates, and other metadata-specific information. '
      responses:
        '200':
          description: |-
            OK

            Response code 200 is returned with the message "Sample sent for rescanning" when the sample with the requested hash is found in storage.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/rescan/v1/query/sha1/289512144b8b4e9e25e7a7d6250da24cda02eee0' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/rescan/v1/query/sha1/bc7a6c7bba614456412fcd11d870f207be1bf6a5"

            payload="<file contents here>"
            headers = {
              'Content-Type': 'application/json'
            }

            response = requests.get(url, headers=headers, data=payload, auth=('username', 'password'))

            print(response.text)
  /api/rescan/v1/bulk_query/{post_format}:
    post:
      summary: 'TCA-0205: Re-Analyze File Bulk Query'
      tags:
        - Automation
      operationId: post-api-rescan-v1-bulk-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - $ref: '#/components/parameters/ResponseBulk'
      description: 'The Rescan API allows users to submit files for (re)analysis in the ReversingLabs Spectra Intelligence system. Up to 100 hashes can be submitted in one request. Re-analysis includes all components of the ReversingLabs Classification Algorithm: Spectra Intelligence antivirus scan results, threat and trust factors, parent/child relationships, certificates, and other metadata-specific information. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      sent_for_rescan:
                        - b363713a938afcd3c74603827fab79e935b2b09b
                        - a7afddb68260a60f86c02a021efba7f216c2e7cf
                      sample_unavailable:
                        - ca03064987d3c4465f91552ba8b6a883eecfd3e5
                      invalid_hashes:
                        - example_of_a_wrong_hash
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      sent_for_rescan:
                        type: array
                        items:
                          type: string
                      sample_unavailable:
                        type: array
                        items:
                          type: string
                      unknown_hashes:
                        type: array
                        items:
                          type: string
                      invalid_hashes:
                        type: array
                        items:
                          type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/rescan/v1/bulk_query/json' --header 'Content-Type: application/json' --data '{
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b"
                  ]
                }
              }
            }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/rescan/v1/bulk_query/json?format=json"

            json = {
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b",
                    "example_of_a_wrong_hash"
                  ]
                }
              }
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        $ref: '#/components/requestBodies/BulkRequest'
  /api/subscription/data_change/v1/bulk_query/subscribe/{post_format}:
    post:
      summary: 'TCA-0206: Alert Subscribe Query'
      tags:
        - Automation
      operationId: post-api-subscription-data_change-bulk-subscribe
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - $ref: '#/components/parameters/ResponseBulk'
      description: |-
        This query is used for subscribing to a list of samples and URLs for which the changed sections (if there are any) will be delivered in the Data Change Feed. To subscribe to a list of samples or URLs, the user should submit the sample or URL hashes in a POST request. All hashes in a request should be of the same type. The maximum amount of hashes that can be submitted in one request is 100.

        Subscriptions never expire on their own. Users need to manually unsubscribe using the TCA-0206 Unsubscribe Query. **Note:** Samples or URLs that have not yet been seen can be subscribed to only using SHA1 hash values.
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      subscription_data_change:
                        invalid_hashes:
                          - example_of_a_wrong_hash
                        subscribed:
                          - ca03064987d3c4465f91552ba8b6a883eecfd3e5
                          - b363713a938afcd3c74603827fab79e935b2b09b
                          - a7afddb68260a60f86c02a021efba7f216c2e7cf
                        hash_type: sha1
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      subscription_data_change:
                        type: object
                        properties:
                          subscribed:
                            type: array
                            items:
                              type: string
                          invalid_hashes:
                            type: array
                            items:
                              type: string
                          unknown_hashes:
                            type: array
                            items:
                              type: string
                          hash_type:
                            type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/subscription/data_change/v1/bulk_query/subscribe/json' --data ' {
                "rl": {
                  "query": {
                    "hash_type":"sha1",
                    "hashes": [
                      "84dbb381485e6ee9d69fbad3c6f020be88230e9b",
                      "81648fd7871017eef87e0efa166e00e891a6ea9d",
                      "0761c95bd639466aff2d65c1c092e2cae40f900c",
                      "552ec95c8ffe3a0cb014eee508b87730461c8f26",
                      "d234189a25892325746699fe2ab39a40b2d14d6e"
                    ]
              }}}' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/subscription/data_change/v1/bulk_query/subscribe/json?format=json"

            json = {
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b",
                    "example_of_a_wrong_hash"
                  ]
                }
              }
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        $ref: '#/components/requestBodies/BulkRequest'
  /api/subscription/data_change/v1/bulk_query/unsubscribe/{post_format}:
    post:
      summary: 'TCA-0206: Alert Unsubscribe Query'
      tags:
        - Automation
      operationId: post-api-subscription-data_change-bulk-unsubscribe
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - $ref: '#/components/parameters/ResponseBulk'
      description: |-
        This query is used for unsubscribing from a list of samples that the user was previously subscribed to. Submitting a sample hash in a POST request to this endpoint removes the associated sample from the list of user's subscriptions.

        The maximum amount of hashes that can be submitted in one request is 100. Changes for unsubscribed samples will no longer be delivered in the Data Change Feed.
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      subscription_data_change:
                        invalid_hashes:
                          - example_of_a_wrong_hash
                        unsubscribed:
                          - ca03064987d3c4465f91552ba8b6a883eecfd3e5
                          - b363713a938afcd3c74603827fab79e935b2b09b
                          - a7afddb68260a60f86c02a021efba7f216c2e7cf
                        hash_type: sha1
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      subscription_data_change:
                        type: object
                        properties:
                          invalid_hashes:
                            type: array
                            items:
                              type: string
                          unsubscribed:
                            type: array
                            items:
                              type: string
                          unknown_hashes:
                            type: array
                            items:
                              type: string
                          hash_type:
                            type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/subscription/data_change/v1/bulk_query/unsubscribe/json' --data '{
                "rl": {
                 "query": {
                   "hash_type":"sha1",
                   "hashes": [
                     "84dbb381485e6ee9d69fbad3c6f020be88230e9b",
                     "81648fd7871017eef87e0efa166e00e891a6ea9d",
                     "0761c95bd639466aff2d65c1c092e2cae40f900c",
                     "552ec95c8ffe3a0cb014eee508b87730461c8f26",
                     "d234189a25892325746699fe2ab39a40b2d14d6e"
                   ]
             }}}' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/subscription/data_change/v1/bulk_query/unsubscribe/json?format=json"

            json = {
              "rl": {
                "query": {
                  "hash_type": "sha1",
                  "hashes": [
                    "a7afddb68260a60f86c02a021efba7f216c2e7cf",
                    "ca03064987d3c4465f91552ba8b6a883eecfd3e5",
                    "b363713a938afcd3c74603827fab79e935b2b09b",
                    "example_of_a_wrong_hash"
                  ]
                }
              }
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        $ref: '#/components/requestBodies/BulkRequest'
  /api/feed/data_change/v3/start/{time_format}/{time_value}:
    put:
      summary: 'TCA-0206: Data Change Feed Start Query'
      tags:
        - Automation
      operationId: put-api-feed-data_change-v3-start
      parameters:
        - name: time_format
          in: path
          schema:
            type: string
            enum:
              - timestamp
              - utc
          required: true
          description: 'Required parameter; accepts these options: **timestamp**, **utc**. **timestamp** is the number of seconds since 1970-01-01 00:00:00. **utc** is the date and time in format YYYY-MM-DDThh:mm:ss'
        - name: time_value
          in: path
          schema:
            type: string
          required: true
          description: Required parameter; Accepts values defined by the **time_format** parameter
      description: This query sets the starting timestamp for TCA-0206 Data Change Feed Pull Query.
      responses:
        '200':
          description: The request has succeeded.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request PUT --url 'https://data.reversinglabs.com/api/feed/data_change/v3/start/timestamp/1640991600' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/feed/data_change/v3/start/timestamp/1704067200"

            response = requests.put(url, auth=('username', 'password'))

            print(response.text)
  /api/feed/data_change/v3/pull:
    get:
      summary: 'TCA-0206: Data Change Feed Pull Query'
      tags:
        - Automation
      operationId: get-api-feed-data_change-v3-pull
      parameters:
        - name: events
          in: query
          schema:
            type: string
            default: default
            enum:
              - default
              - sections
          description: 'Optional parameter that accepts a list of sections that should be included in the response, delimited by commas. Supported values: **default** - all events will be included in the response; **sections** - include info, sources, xref, analysis, sample_available, malware_presence, sample_became_shareable, dynamic_analysis'
        - name: format
          in: query
          schema:
            type: string
            default: xml
            enum:
              - xml
              - json
              - tsv
          description: 'Optional parameter; Specifies the response format. Supported values: **xml** (default), **json**, **tsv** (Tab Separated Values, delimiter character \t 0x09)'
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
            default: 1000
          description: Optional parameter; Specifies the number of records to return in the response. The maximum value is 1000. Note that the response may include a little more than the requested number of records to ensure that all the records with the same timestamp are returned.
      description: |-
        This query returns the next recordset with samples and URLs to which the user is subscribed. The starting point for this query is defined using the TCA-0206 Start Query.

        If the user has not previously requested this query or called the START query, it will return records starting with the current timestamp. Every subsequent call will continue from the timestamp where the previous call ended.

        Unless the limit parameter is specified, the query returns a maximum of 1000 records, or a little bit more than 1000 if there are records with the same timestamp. This ensures that all the records with the same timestamp will be included in the recordset. The limit parameter must not be greater than 1000.

        This endpoint is built to be queried by a single thread (single instance). Any concurrent requests will be blocked until the previous one is fulfilled.
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      data_change_feed:
                        entries:
                          - record_on: '2022-04-13T18:07:14'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - malware_presence
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                          - record_on: '2022-04-13T18:07:14'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - xref
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                          - record_on: '2022-04-13T18:09:14'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - malware_presence
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                          - record_on: '2022-04-13T18:09:14'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - xref
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                          - record_on: '2022-04-13T18:11:45'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - malware_presence
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                          - record_on: '2022-04-13T18:11:45'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - xref
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                          - record_on: '2022-04-13T18:15:15'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - malware_presence
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                          - record_on: '2022-04-13T18:15:15'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - xref
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                          - record_on: '2022-04-13T18:18:16'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - malware_presence
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                          - record_on: '2022-04-13T18:18:16'
                            sha1: 47b15748ecc8e952c5935170090db7c269ce4b4f
                            updated_sections:
                              - xref
                            sha256: 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
                            md5: 0cd8c971317d19bbed44757809bcb92b
                        last_timestamp: 1649873896
                        time_range:
                          to: '2022-04-13T18:18:16'
                          from: '2022-04-13T18:03:14'
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      data_change_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            items:
                              type: object
                              properties:
                                record_on:
                                  type: string
                                sha1:
                                  type: string
                                updated_sections:
                                  type: array
                                  items:
                                    type: string
                                    enum:
                                      - xref
                                      - sample_available
                                      - malware_presence
                                      - sample_became_shareable
                                      - dynamic_analysis
                                    example: malware_presence
                                sha256:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: integer
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/feed/data_change/v3/pull?events=xref&format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/feed/data_change/v3/pull?events=xref,sample_available,rca2_malware_presence_compatibility,malware_presence,sample_became_shareable&format=json&limit=100"

            response = requests.get(url, auth=('username', 'password'))

            print(response.text)
      requestBody:
        $ref: '#/components/requestBodies/BulkRequest'
  /api/feed/data_change/v3/query/{time_format}/{time_value}:
    get:
      summary: 'TCA-0206: Data Change Continuous Feed Query'
      tags:
        - Automation
      operationId: get-api-feed-data_change-v3-query
      parameters:
        - name: time_format
          in: path
          schema:
            type: string
            enum:
              - timestamp
              - utc
          required: true
          description: 'Required parameter; accepts these options: **timestamp**, **utc**. **timestamp** is the number of seconds since 1970-01-01 00:00:00. **utc** is the date and time in format YYYY-MM-DDThh:mm:ss'
        - name: time_value
          in: path
          schema:
            type: string
          required: true
          description: Required parameter; Accepts values defined by the **time_format** parameter
        - name: events
          in: query
          schema:
            type: string
            default: default
            enum:
              - default
              - sections
          description: 'Optional parameter that accepts a list of sections that should be included in the response, delimited by commas. Supported values: **default** - all events will be included in the response; **sections** - include info, sources, xref, analysis, sample_available, malware_presence, sample_became_shareable, dynamic_analysis'
        - name: format
          in: query
          schema:
            type: string
            default: xml
            enum:
              - xml
              - json
              - tsv
          description: 'Optional parameter; Specifies the response format. Supported values: **xml** (default), **json**, **tsv** (Tab Separated Values, delimiter character \t 0x09)'
      description: |-
        This query returns a recordset with samples and URLs that the user is subscribed to from the requested timestamp onwards. The feed will return 1000 records at most, or a little bit more than 1000 if there are some records with the same timestamp. The response also contains the latest timestamp up to which the events are included in the response.

        To fetch the next recordset, use the **last_timestamp** value from the response, increase it by 1 and submit it in a new request.
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      data_change_feed:
                        time_range:
                          from: '2025-01-21T12:58:31'
                          to: '2025-01-23T11:19:12'
                        entries: []
                        last_timestamp: 1737631152
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      data_change_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            items:
                              type: object
                              properties:
                                record_on:
                                  type: string
                                sha1:
                                  type: string
                                updated_sections:
                                  type: array
                                  items:
                                    type: string
                                    enum:
                                      - xref
                                      - sample_available
                                      - malware_presence
                                      - sample_became_shareable
                                      - dynamic_analysis
                                    example: sample_became_shareable
                                sha256:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: integer
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/feed/data_change/v3/query/utc/2022-01-01T13:00:00?format=json&events=xref' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/feed/data_change/v3/query/utc/2025-01-01T00:00:00?format=json&events=xref"

            response = requests.get(url, auth=('username', 'password'))

            print(response.text)
  /api/dynamic/analysis/analyze/v1/query/{post_format}:
    post:
      summary: 'TCA-0207: File/URL Dynamic Analysis'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: post-api-dynamic-analysis-analyze-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: |-
        The File and URL Dynamic Analysis service allows users to detonate a file and URL in the ReversingLabs cloud sandbox. Several different sandbox profiles are available:
        1. Win11 22H2 (MS Office 2016, Adobe Reader 21, Java 8, Google Chrome 113, Firefox 96, Python 3.9)
        2. Win10 x64 (MS Office 2007, Java 8, update 261, Adobe Reader 2020.012.20048, Firefox 62.0.3, Google Chrome 69.0.3497.100, Microsoft Edge 42.17134.1.0, Internet Explorer 11)
        3. Win7 x64 (build 760, MS Office 2007, Java 7, update 45, Adobe Reader 8.1.2, Firefox 37, Google Chrome 51.0.2704.84, Internet Explorer 8)
        4. macOS 11 (MacOS Big Sur; Safari 14.1.2; Acrobat Reader 22.003.20258)
        5. Linux (Ubuntu 20.04 Server; Kernel 5.4.0-72-generic, LibreOffice 7.5.3.2, OpenJDK 11.0.18,  Adobe Reader 9.5.5, Firefox 112.0.2, Python 3.8, Ruby 2.7)

        The report about the performed analysis and file behavior can be retrieved using the TCA-0106 Dynamic Analysis Report service. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_hash: 3c3ce51a7ab839c2f412fb06212fcf6a92932252
                      analysis_id: f9d52a52-50b9-4d67-b15d-52b0182338ce
                      status: started
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - status
                      - requested_hash
                      - analysis_id
                    properties:
                      status:
                        type: string
                      requested_hash:
                        type: string
                      analysis_id:
                        type: string
                        description: Use this value to find specific analysis runs using TCA-0106.
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/dynamic/analysis/analyze/v1/query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
              "rl": {
                "url": "http://www.google.com",
                "platform": "windows7",
                "response_format": "json",
                "optional_parameters": "geolocation=us, locale=en-US"
                }
              }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/dynamic/analysis/analyze/v1/query/json"

            json = {
              "rl": {
                "url": "http://www.google.com",
                "platform": "windows7",
                "response_format": "json",
                "optional_parameters": "geolocation=us, locale=en-US"
                }
              }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        description: Up to 100 hashes can be submitted in one request.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  oneOf:
                    - title: File upload
                      properties:
                        sha1:
                          type: string
                          minLength: 40
                          maxLength: 40
                          example: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
                          description: SHA1 hash of a file present in Spectra Intelligence. It must match a previously uploaded sample of a supported file type.
                        platform:
                          type: string
                          enum:
                            - windows7
                            - windows10
                            - windows11
                            - macos11
                            - linux
                          example: windows10
                        interactive:
                          type: string
                          description: |
                            Available only to Spectra Analyze instances with the proper role.
                          enum:
                            - 'true'
                            - 'false'
                        timeout:
                          type: number
                          minimum: 30
                          maximum: 500
                          description: |
                            How long (in seconds) a sample can run in the sandbox virtual machine.
                            Different from total analysis time, which will be longer than the timeout.
                        response_format:
                          type: string
                          minLength: 3
                          enum:
                            - xml
                            - json
                          example: json
                          maxLength: 4
                          default: json
                        optional_parameters:
                          type: string
                          description: |
                            Additional optional parameters to send with the request. Provide the optional parameters in the format of a comma-delimited string.

                            `internet_simulation`: Available only for the SHA1 hash submissions. If `internet_simulation` is set to `true`, dynamic analysis will be performed without connecting to the internet and will use a simulated network instead. Setting it to `false` is the same as omitting it from the request. HTTPS traffic information will not be monitored within the report when using the `internet_simulation` parameter.

                            `sample_name`: Available only for the SHA1 hash submissions. Specifies a custom file name and/or extension for the sample. Custom extensions impact which application will be used to open and run the file.

                            `geolocation`: Geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods. Supported geographic location values are: `us` (default), `uk`, `in`, `br`, `de`, `jp`, `sg`, `it`, `es`, `fr`, `tor`.

                            `locale`: Locale setting reflecting the configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes. Supported locale values are: `en-US` (default), `en-GB`, `pt-BR`, `de-DE`, `ja-JP`, `it-IT`, `es-ES`, `fr-FR`.

                            Example:

                            `"optional_parameters": "internet_simulation=true, sample_name=Sample, geolocation=us, locale=en-US"`
                    - title: URL upload
                      properties:
                        url:
                          type: string
                          description: The URL, IP address, or domain to be analyzed.
                        platform:
                          type: string
                          enum:
                            - windows7
                            - windows10
                            - macos11
                        interactive:
                          type: boolean
                          description: Available only to Spectra Analyze instances with the proper role
                        timeout:
                          type: number
                          minimum: 30
                          maximum: 500
                          description: |
                            How long (in seconds) a sample can run in the sandbox virtual machine.
                            Different from total analysis time, which will be longer than the timeout.
                        response_format:
                          type: string
                          minLength: 3
                          enum:
                            - xml
                            - json
                          example: json
                          maxLength: 4
                          default: json
                        optional_parameters:
                          type: string
                          description: |
                            Additional optional parameters to send with the request. Provide the optional parameters in the format of a comma-delimited string.

                            `geolocation`: Geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods. Supported geographic location values are: `us` (default), `uk`, `in`, `br`, `de`, `jp`, `sg`, `it`, `es`, `fr`, `tor`.

                            `locale`: Locale setting reflecting the configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes. Supported locale values are: `en-US` (default), `en-GB`, `pt-BR`, `de-DE`, `ja-JP`, `it-IT`, `es-ES`, `fr-FR`.

                            Example:

                            `"optional_parameters": "geolocation=us, locale=en-US"`
                    - title: URL Base64 upload
                      properties:
                        url_base64:
                          type: string
                          description: Base64 encoded URL, IP address, or domain to be analyzed. The value is decoded and normalized, and then used to calculate a SHA1 and Base64 of the normalized URL/IP/Domain.
                        platform:
                          type: string
                          enum:
                            - windows7
                            - windows10
                            - macos11
                        interactive:
                          type: boolean
                          description: Available only to Spectra Analyze instances with the proper role
                        timeout:
                          type: number
                          minimum: 30
                          maximum: 500
                          description: |
                            How long (in seconds) a sample can run in the sandbox virtual machine.
                            Different from total analysis time, which will be longer than the timeout.
                        response_format:
                          type: string
                          minLength: 3
                          enum:
                            - xml
                            - json
                          example: json
                          maxLength: 4
                          default: json
                        optional_parameters:
                          type: string
                          description: |
                            Additional optional parameters to send with the request. Provide the optional parameters in the format of a comma-delimited string.

                            `geolocation`: Geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods. Supported geographic location values are: `us` (default), `uk`, `in`, `br`, `de`, `jp`, `sg`, `it`, `es`, `fr`, `tor`.

                            `locale`: Locale setting reflecting the configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes. Supported locale values are: `en-US` (default), `en-GB`, `pt-BR`, `de-DE`, `ja-JP`, `it-IT`, `es-ES`, `fr-FR`.

                            Example:

                            `"optional_parameters": "geolocation=us, locale=en-US"`
              required:
                - rl
  /api/dynamic/analysis/analyze/v1/archive/query/{post_format}:
    post:
      summary: 'TCA-0207: Dynamic Analysis (archives)'
      tags:
        - Dynamic Analysis (ReversingLabs Cloud Sandbox)
      operationId: post-api-dynamic-analysis-analyze-archive-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: |-
        The Dynamic Analysis service allows users to detonate a file in the ReversingLabs cloud sandbox. Several different sandbox profiles are available:
        1. Win11 22H2 (MS Office 2016, Adobe Reader 21, Java 8, Google Chrome 113, Firefox 96, Python 3.9)
        2. Win10 x64 (MS Office 2007, Java 8, update 261, Adobe Reader 2020.012.20048, Firefox 62.0.3, Google Chrome 69.0.3497.100, Microsoft Edge 42.17134.1.0, Internet Explorer 11)
        3. Win7 x64 (build 760, MS Office 2007, Java 7, update 45, Adobe Reader 8.1.2, Firefox 37, Google Chrome 51.0.2704.84, Internet Explorer 8)
        4. macOS 11 (MacOS Big Sur; Safari 14.1.2; Acrobat Reader 22.003.20258)
        5. Linux (Ubuntu 20.04 Server; Kernel 5.4.0-72-generic, LibreOffice 7.5.3.2, OpenJDK 11.0.18, Adobe Reader 9.5.5, Firefox 112.0.2, Python 3.8, Ruby 2.7)

        The report about the performed analysis and file behavior can be retrieved using the TCA-0106 Dynamic Analysis Report service. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      requested_hash: e662bfd39cf389b0bad5262e6007c09824261ee4
                      files:
                        - sha1: zzzf8d4dd290435a978e70adcf7876c0
                          analysis_id: bedf8d4d-d290-435a-978e-70adcf7876c0
                          status: started
                        - sha1: bbbf8d4dd290435a978e70adcf7876c0
                          analysis_id: uuuf8d4d-d290-435a-978e-70adcf7876c0
                          status: started
                        - sha1: zzzf8d4dd290435a978e70adcf7876c0
                          analysis_id: hhhf8d4d-d290-435a-978e-70adcf7876c0
                          status: started
                        - sha1: cccf8d4dd290435a978e70adcf7876c0
                          analysis_id: zzzf8d4d-d290-435a-978e-70adcf7876c0
                          error_message: sample_size_exceeds
                        - sha1: uuuf8d4dd290435a978e70adcf7876c0
                          analysis_id: lllf8d4d-d290-435a-978e-70adcf7876c0
                          error_message: filetype_not_supported
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - status
                      - requested_hash
                      - analysis_id
                    properties:
                      status:
                        type: string
                      requested_hash:
                        type: string
                      analysis_id:
                        type: string
                        description: Use this value to find specific analysis runs using TCA-0106.
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/dynamic/analysis/analyze/v1/archive/query/json' --header 'Content-Type: application/json' --data '{
              "rl": {
                "sha1": "54bdccd42f89242ba21fd1a48fcb438a2a2c1829",
                "platform": "windows7",
                "response_format": "json"
                }
              }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/dynamic/analysis/analyze/v1/archive/query/json"

            json = {
              "rl": {
                "sha1": "54bdccd42f89242ba21fd1a48fcb438a2a2c1829",
                "platform": "windows7",
                "response_format": "json",
                "optional_parameters": "internet_simulation=true"
                }
              }

            headers = {
              'Content-Type': 'application/json'
            }

            response = requests.post(url, headers=headers, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        description: |-
          `hash_type` is a required parameter that specifies which hash type will be used in the request. Supported values: **md5**, **sha1**, **sha256**.
           
          `hash_value` is a required parameter that specifies the hash of the file for which the user is requesting data from the service. The value must be a valid hash of the same type specified by the `hash_type` parameter.
           
          Up to 100 hashes can be submitted in one request.
        required: true
        content:
          application/json:
            schema:
              description: ''
              type: object
              properties:
                rl:
                  type: object
                  required:
                    - sha1
                    - platform
                  properties:
                    sha1:
                      type: string
                      minLength: 40
                      maxLength: 40
                      example: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
                      description: SHA1 hash of a file present in Spectra Intelligence.
                    platform:
                      type: string
                      enum:
                        - windows7
                        - windows10
                        - windows11
                        - macos11
                        - linux
                      example: windows10
                    response_format:
                      type: string
                      minLength: 3
                      enum:
                        - xml
                        - json
                      example: json
                      maxLength: 4
                      default: json
                    optional_parameters:
                      type: string
                      description: |
                        Additional optional parameters to send with the request. Provide the optional parameters in the format of a comma-delimited string.

                        `internet_simulation`: Available only for the SHA1 hash submissions. If `internet_simulation` is set to `true`, dynamic analysis will be performed without connecting to the internet and will use a simulated network instead. Setting it to `false` is the same as omitting it from the request. HTTPS traffic information will not be monitored within the report when using the `internet_simulation` parameter.

                        `sample_name`: Available only for the SHA1 hash submissions. Specifies a custom file name and/or extension for the sample. Custom extensions impact which application will be used to open and run the file.

                        `geolocation`: Geographic location associated with the sample's network activity, reflecting the configured country from which the network traffic is egressed, set via VPN or similar routing methods. Supported geographic location values are: `us` (default), `uk`, `in`, `br`, `de`, `jp`, `sg`, `it`, `es`, `fr`, `tor`.

                        `locale`: Locale setting reflecting the configured OS language, region, and keyboard layout to simulate a specific country or environment for anti-evasion or targeted analysis purposes. Supported locale values are: `en-US` (default), `en-GB`, `pt-BR`, `de-DE`, `ja-JP`, `it-IT`, `es-ES`, `fr-FR`.

                        Example:

                        `"optional_parameters": "internet_simulation=true, sample_name=Sample, geolocation=us, locale=en-US"`
              required:
                - rl
    parameters: []
  /api/group_by_rha1/v1/query/{rha1_type}/{hash_value}/{next_page_sha1}:
    get:
      summary: 'TCA-0301: Group By RHA1 Single Query'
      tags:
        - Malware Hunting
      operationId: get-api-group_by_rha1-v1-query-rha1_type-hash_value
      parameters:
        - name: rha1_type
          in: path
          required: true
          schema:
            type: string
          description: 'Required parameter. A measure of RHA1 precision level; represents the degree to which a file is functionally similar to another file. A higher precision level will match fewer files, but the files will have more functional similarity. The following precision levels are supported - 25% for PE, MachO and ELF files (expressed as pe01, elf01, machO01), and 50% for PE files (expressed as pe02). This parameter accepts one of the following values: **pe01, elf01, machO01, pe02**'
        - name: hash_value
          in: path
          required: true
          schema:
            type: string
          description: Required parameter. The value must be a valid SHA1 hash of the sample for which the user is requesting a list of functionally similar samples.
        - $ref: '#/components/parameters/NextPage'
        - $ref: '#/components/parameters/ResponseFormat'
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
            default: 1000
            example: 50
          description: Optional parameter that specifies the maximum number of sample SHA1 hashes to return in the response. This value has to be an integer in the range from 1 and 1000. When the parameter is not included in the request, 1000 hashes are returned in the response.
        - name: extended
          in: query
          schema:
            type: boolean
            default: 'false'
            example:
              - true
          description: 'Optional parameter. Supported values are **true** (sends the extended data set in the response) and **false** (sends only the list of SHA1 hashes). The default is **false**. If the extended option is selected, each SHA1 hash in the list will be expanded with additional metadata: classification, threat level, trust factor, malware family name, threat name, malware type, targeted platform and subplatform; SHA1, MD5, and SHA256 hashes; sample size, sample type, download availability, first and last seen dates (UTC).'
        - $ref: '#/components/parameters/Classification'
      description: 'The RHA Functional Similarity [Group by RHA1] API provides a list of SHA1 hashes of files that are functionally similar to the requested file (SHA1 hash) at the selected precision level. The files are grouped by their RHA1 hash. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      group_by_rha1:
                        query_sha1: 00c3ddd93924df51e10585167271e27b4cfb29c5
                        rha1_type: pe01
                        sha1_list:
                          - sha1: 0000dac7e0a238ff39f85a55b090fba0033de120
                            sha256: 1c39f231761045d6b1d6f52c6122b4b313381c09a6001d8b23453af2e1bc666d
                            md5: e185f87ede2f52916b308a672f1c4ba0
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 163736
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Phonzy
                            malware_family: Phonzy
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-03-24T07:21:25.452000'
                            last_seen: '2022-03-24T09:50:38.799000'
                          - sha1: 00011cc1efe61edcd44779896f620ea3466a575a
                            sha256: 450f2dd1e89d3b3a9760683555a64f815c3487025f119251c051134c579d0de6
                            md5: 4efaabe63332ddf1ca31208b511280d9
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 201010
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Phonzy
                            malware_family: Phonzy
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-06-11T02:54:34.045000'
                            last_seen: '2022-06-11T03:10:38.761000'
                          - sha1: 0001304e87726a391311cf4770c1cec0372eb930
                            sha256: 03fb5c2bb88a5a5e025b0597dece833e76f3587de6ebfe1a04fc68cc22cbe895
                            md5: 42e7cb9a3cf39335bfc4cb87043f43e4
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 207986
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Phonzy
                            malware_family: Phonzy
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-06-03T08:32:06.676000'
                            last_seen: '2022-06-03T08:46:01.750000'
                          - sha1: 000149f40e35b1159e1d5cfe09746623ac07cbdc
                            sha256: 49b8bbf61ac59d384fae150d78ae995746f175496dd0f64d0e729e669406310d
                            md5: 8ae17e3d363b411e65be4775ab405a50
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 241124
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Phonzy
                            malware_family: Phonzy
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-03-23T03:57:05.778000'
                            last_seen: '2022-03-23T04:22:08.524000'
                          - sha1: 0001b9fdb128e11a72e58775008ab69b13782ac9
                            sha256: 5c9f031bbfc67467ab1448101705c6ccd1390c30a58c8ffa932f68e672f522b0
                            md5: 0c06e517df34ff461d2b6b396ec15207
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 206285
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Phonzy
                            malware_family: Phonzy
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-04-14T14:46:05.790000'
                            last_seen: '2022-04-14T15:11:54.804000'
                          - sha1: 0001ed161168ddd202d89501754565920395f2d2
                            sha256: 89b5db75d92a66b4d106ea6ff7bc79354700525f0b33a49e0bffbffeb79561f8
                            md5: 685935aae52706dc411a6cf05ef77c74
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 215204
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Phonzy
                            malware_family: Phonzy
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-05-25T13:48:56.289000'
                            last_seen: '2022-05-25T14:16:03.603000'
                          - sha1: 0001eef082c56c42f1c5db5cc0da859c06ba2149
                            sha256: a8255c15135ba135dc80e80f62e090ab36e97ccabeb243cbea132990dad213d6
                            md5: b27ba2e5e4e7db5636fa33664fa32337
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 187255
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Phonzy
                            malware_family: Phonzy
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-03-06T21:45:28.643000'
                            last_seen: '2022-03-06T21:58:15.457000'
                          - sha1: 00024822e72f28d3c84f43170027c0aa48c74380
                            sha256: 17edd253c150d54c96c8280268ff6d326e77cad17bbbb7fb0e9776b5f7eb2234
                            md5: 545f8c8d946aba46a1584f50bbb2d6c8
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 177239
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Phonzy
                            malware_family: Phonzy
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-06-29T06:02:08.477000'
                            last_seen: '2022-06-29T06:19:18.458000'
                          - sha1: 0002c709fad77b8be797c8c4c4c926322a851a69
                            sha256: 4d45a34c7562348de32b7ab37ccc8a68b3f25ac18a28075961caf502d4deecf4
                            md5: 258114397ce42302bfeff81093e0fcc0
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 177548
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Phonzy
                            malware_family: Phonzy
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-06-16T22:10:25.152000'
                            last_seen: '2022-06-16T22:23:51.674000'
                          - sha1: 000327ce82f57e15b1ba63d378a4c74261a194b9
                            sha256: 63f8b29d41ff6ab7aecb87b22a8b2fb50ae679ba079b1cfd737043fca8fc19ba
                            md5: ba152dfa436cf41477ef571c03450896
                            classification: MALICIOUS
                            sample_type: PE/Exe
                            sample_size: 253171
                            sample_available: true
                            trust_factor: 5
                            threat_level: 5
                            threat_name: Win32.Trojan.Mamson
                            malware_family: Mamson
                            malware_type: Trojan
                            platform: Win32
                            first_seen: '2022-07-03T07:54:46.039000'
                            last_seen: '2022-07-03T08:04:44.761000'
                        next_page_sha1: 0003573e25179d3fb14229b2e6cb56f46c53f719
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      group_by_rha1:
                        type: object
                        properties:
                          query_sha1:
                            type: string
                          rha1_type:
                            type: string
                          sha1_list:
                            type: array
                            items:
                              type: object
                              properties:
                                sha1:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                                classification:
                                  type: string
                                sample_type:
                                  type: string
                                sample_size:
                                  type: integer
                                sample_available:
                                  type: boolean
                                trust_factor:
                                  type: integer
                                threat_level:
                                  type: integer
                                threat_name:
                                  type: string
                                malware_family:
                                  type: string
                                malware_type:
                                  type: string
                                platform:
                                  type: string
                                first_seen:
                                  type: string
                                last_seen:
                                  type: string
                          next_page_sha1:
                            type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/group_by_rha1/v1/query/pe01/00c3ddd93924df51e10585167271e27b4cfb29c5?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/group_by_rha1/v1/query/pe01/00c3ddd93924df51e10585167271e27b4cfb29c5?format=json&limit=100&extended=true&classification=malicious"

            response = requests.get(url, auth=('username', 'password'))

            print(response.text)
    parameters:
      - schema:
          type: string
        name: rha1_type
        in: path
        required: true
      - schema:
          type: string
        name: hash_value
        in: path
        required: true
      - schema:
          type: string
        name: next_page_sha1
        in: path
  /api/imphash_index/v1/query/{hash_value}:
    get:
      summary: 'TCA-0302: ImpHash Similarity'
      tags:
        - Malware Hunting
      operationId: api-imphash-index-query
      description: The ImpHash Similarity API provides a list of all available SHA1 hashes for the requested import hash (imphash).
      parameters:
        - name: hash_value
          in: path
          required: true
          schema:
            type: string
          description: Required parameter. The value must be a valid ImpHash hash for which the user is requesting a list of SHA1 hashes.
        - name: format
          in: query
          schema:
            type: string
            enum:
              - json
              - xml
          description: The response format.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
          description: Maximum number of results returned.
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NormalImphashResponse'
              examples:
                normal:
                  value:
                    rl:
                      imphash_index:
                        next_page_sha1: 04869a625ea7d92fd8d1668aec77efd38a0c2506
                        query_imphash: 0931e97555ac33eb10aa9539fe890070
                        sha1_list:
                          - 00018a78a1cae0ad6bf5bfb712147e99a4b15577
                          - 0001cf4ef8aa7d50b014318743edac57fa31c569
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/imphash_index/v1/query/{hash_value}/next_page_sha1/{next_page_sha1}:
    get:
      summary: 'TCA-0302: ImpHash Similarity (paginated)'
      tags:
        - Malware Hunting
      operationId: api-imphash-index-v1-query-paginated
      description: The ImpHash Similarity API provides a list of all available SHA1 hashes for the requested import hash (imphash). Use the `page` parameter to paginate results.
      parameters:
        - name: hash_value
          in: path
          required: true
          schema:
            type: string
          description: Required parameter. The value must be a valid ImpHash hash for which the user is requesting a list of SHA1 hashes.
        - $ref: '#/components/parameters/NextPage'
        - name: format
          in: query
          schema:
            type: string
            enum:
              - json
              - xml
          description: The response format.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
          description: Maximum number of results returned.
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NormalImphashResponse'
              examples:
                normal:
                  value:
                    rl:
                      imphash_index:
                        next_page_sha1: 04869a625ea7d92fd8d1668aec77efd38a0c2506
                        query_imphash: 0931e97555ac33eb10aa9539fe890070
                        sha1_list:
                          - 00018a78a1cae0ad6bf5bfb712147e99a4b15577
                          - 0001cf4ef8aa7d50b014318743edac57fa31c569
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/imphash_index/v1/query/sample/{hash_value}:
    get:
      summary: 'TCA-0302: ImpHash Similarity By Sample Hash'
      tags:
        - Malware Hunting
      operationId: api-imphash-index-sample-query
      description: The ImpHash Similarity API provides a list of all available SHA1 hashes for the requested sample hash.
      parameters:
        - name: hash_value
          in: path
          required: true
          schema:
            type: string
          description: SHA1 hash of the sample to query for imphash similarity.
        - name: format
          in: query
          schema:
            type: string
            enum:
              - json
              - xml
          description: The response format.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
          description: Maximum number of results returned.
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NormalImphashResponseSample'
              examples:
                normal:
                  value:
                    rl:
                      imphash_index:
                        next_page: 04869a625ea7d92fd8d1668aec77efd38a0c2506
                        query_hash: 000a24c24e2c9c222d5aa662161646e4661f5929
                        list:
                          - 00018a78a1cae0ad6bf5bfb712147e99a4b15577
                          - 0001cf4ef8aa7d50b014318743edac57fa31c569
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/imphash_index/v1/query/sample/{hash_value}/page/{page}:
    get:
      summary: 'TCA-0302: ImpHash Similarity By Sample Hash (paginated)'
      tags:
        - Malware Hunting
      operationId: api-imphash-index-v1-sample-query-paginated
      description: The ImpHash Similarity API provides a list of all available SHA1 hashes for the requested sample SHA1 hash. Use the `page` parameter to paginate results.
      parameters:
        - name: hash_value
          in: path
          required: true
          schema:
            type: string
          description: SHA1 hash of the sample to query for imphash similarity.
        - $ref: '#/components/parameters/Page'
        - name: format
          in: query
          schema:
            type: string
            enum:
              - json
              - xml
          description: The response format.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
          description: Maximum number of results returned.
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NormalImphashResponseSample'
              examples:
                normal:
                  value:
                    rl:
                      imphash_index:
                        next_page: 04869a625ea7d92fd8d1668aec77efd38a0c2506
                        query_hash: 000a24c24e2c9c222d5aa662161646e4661f5929
                        list:
                          - 00018a78a1cae0ad6bf5bfb712147e99a4b15577
                          - 0001cf4ef8aa7d50b014318743edac57fa31c569
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/yara/admin/v1/ruleset:
    get:
      summary: 'TCA-0303: Get All Rulesets'
      tags:
        - Malware Hunting
      operationId: get-api-yara-admin-v1-ruleset
      description: This query lists the user's ruleset collection. Returns information about all YARA rulesets belonging to the authenticated user, including their validation status and availability.
      responses:
        '200':
          description: Successfully fetched the list of rulesets.
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    ruleset_name:
                      type: string
                      description: The name of the ruleset, specified by the user in the creation request.
                      example: example_ruleset
                    valid:
                      type:
                        - boolean
                        - 'null'
                      description: |
                        Ruleset validation status:
                        - `null`: validation is still pending
                        - `true`: validated and declared valid
                        - `false`: validated and declared invalid
                      example: true
                    approved:
                      type:
                        - boolean
                        - 'null'
                      description: |
                        Ruleset approval status:
                        - `null`: approval is still pending
                        - `true`: reviewed and approved by administrator
                        - `false`: reviewed and rejected by administrator
                      example: true
                  required:
                    - ruleset_name
                    - valid
                    - approved
              examples:
                example:
                  value:
                    - ruleset_name: example_ruleset
                      valid: true
                      approved: true
                    - ruleset_name: malware_detection
                      valid: true
                      approved: false
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request GET --url 'https://data.reversinglabs.com/api/yara/admin/v1/ruleset' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/yara/admin/v1/ruleset"

            response = requests.get(url, auth=('username', 'password'))

            print(response.text)
    post:
      summary: 'TCA-0303: Create a YARA Ruleset'
      tags:
        - Malware Hunting
      operationId: post-api-yara-admin-v1-ruleset
      description: 'The YARA Ruleset Administration API allows the authenticated user to manage their collection of YARA rulesets in ReversingLabs Spectra Intelligence. All user-submitted rulesets go through a validation phase where they are tested for correctness and efficacy. A ruleset can be declared invalid even if it is syntactically correct, e.g. if it is too broad, and would generate an inordinate amount of matches. '
      responses:
        '201':
          description: The request has been fulfilled, resulting in the creation of a new resource. The ruleset upload request was successfully received.
          content:
            application/json:
              examples:
                example:
                  value:
                    ruleset_name: trickbot_yara
                    ruleset_sha1: a6326b5af078827b742c89b631edb2f2465f1e8e
                    sample_available: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: Conflict. The request could not be completed due to a conflict with the current state of the resource.
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |-
            curl --request POST --url 'https://data.reversinglabs.com/api/yara/admin/v1/ruleset' --header 'Content-Type: application/json' --data '{"ruleset_name": "ExampleRulesetName",
            "text": "rule ExampleRulesetName {condition: false}",
            "sample_available": true}' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/yara/admin/v1/ruleset"

            json = {
              "ruleset_name": "ExampleRulesetName",
              "text": "rule ExampleRulesetName {condition: false}",
              "sample_available": true
            }

            headers = {
              'Content-Type': 'application/json'
            }

            response = requests.post(url, headers=headers, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                sample_available:
                  type: boolean
                ruleset_name:
                  type: string
                ruleset_sha1:
                  type: string
  /api/yara/admin/v1/ruleset/{ruleset_name}:
    delete:
      summary: 'TCA-0303: Delete a YARA Ruleset'
      tags:
        - Malware Hunting
      operationId: delete-api-yara-admin-v1-ruleset-ruleset_name
      description: The YARA Ruleset Administration API allows the authenticated user to manage their collection of YARA rulesets in ReversingLabs Spectra Intelligence. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: |-
            OK

            The ruleset was successfully deleted.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The server has not found anything matching the Request URI / The authenticated user does not have a ruleset with the specified name
        '409':
          description: Conflict. The request could not be completed due to a conflict with the current state of the resource / The authenticated user started a retro hunt with this ruleset. The retro hunt must be finished or cancelled before deleting the ruleset
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request DELETE --url 'https://data.reversinglabs.com/api/yara/admin/v1/ruleset/ExampleRulesetName' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/yara/admin/v1/ruleset/ExampleRulesetName"

            response = requests.delete(url, auth=('username', 'password'))

            print(response.text)
    get:
      summary: 'TCA-0303: Get Ruleset Information'
      tags:
        - Malware Hunting
      operationId: get-api-yara-admin-v1-ruleset
      description: The YARA Ruleset Administration API allows the authenticated user to manage their collection of YARA rulesets in ReversingLabs Spectra Intelligence. If no parameter is specified, this API will return all the user's YARA rulesets.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    ruleset_name: ExampleRulesetName
                    valid: true
                    approved: true
                    sample_available: true
              schema:
                type: object
                properties:
                  valid:
                    type: boolean
                  ruleset_name:
                    type: string
                  approved:
                    type: 'null'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The server has not found anything matching the Request URI / The authenticated user does not have a ruleset with the specified name
        '409':
          description: Conflict. The request could not be completed due to a conflict with the current state of the resource.
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/yara/admin/v1/ruleset/ExampleRulesetName' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/yara/admin/v1/ruleset/ExampleRulesetName"

            headers = {
              'Content-Type': 'application/json'
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - name: ruleset_name
        in: path
        required: true
        schema:
          type: string
          minLength: 3
          maxLength: 48
          pattern: ^[a-z,A-Z,0-9,_-]*$
        description: Parameter used for getting the information about the specified YARA ruleset. Only one ruleset name can be submitted in each request.
  /api/yara/admin/v1/ruleset/{ruleset_name}/text:
    get:
      summary: 'TCA-0303: Get Ruleset Text'
      tags:
        - Malware Hunting
      operationId: get-api-yara-admin-v1-ruleset-text
      description: The YARA Ruleset Administration API allows the authenticated user to manage their collection of YARA rulesets in ReversingLabs Spectra Intelligence. If no parameter is specified, this API will return all the user's YARA rulesets.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    text: 'rule ExampleRulesetName {condition: false}'
              schema:
                type: object
                properties:
                  valid:
                    type: boolean
                  ruleset_name:
                    type: string
                  approved:
                    type: 'null'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The server has not found anything matching the Request URI / The authenticated user does not have a ruleset with the specified name
        '409':
          description: Conflict. The request could not be completed due to a conflict with the current state of the resource.
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/yara/admin/v1/ruleset/ExampleRulesetName' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/yara/admin/v1/ruleset/ExampleRulesetName/text"

            headers = {
              'Content-Type': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - name: ruleset_name
        in: path
        required: true
        schema:
          type: string
          minLength: 3
          maxLength: 48
          pattern: ^[a-z,A-Z,0-9,_-]*$
        description: Parameter used for getting the information about the specified YARA ruleset. Only one ruleset name can be submitted in each request.
  /api/feed/yara/v1/query/{time_format}/{time_value}:
    get:
      summary: 'TCA-0303: YARA Matches Feed'
      tags:
        - Malware Hunting
      operationId: get-api-feed-yara-v1-query-time_format-time_value
      parameters:
        - $ref: '#/components/parameters/TimeFormat'
        - name: time_value
          in: path
          required: true
          schema:
            type: string
          description: Period between the time specified by this parameter and the request time. The earliest supported time value is May 20 2016 00:00h UTC (timestamp 1463702400). The latest supported time value is 10 seconds before the request time. The value must be in the format specified by the `time_format` parameter. To get the next page of results, increase the `last_timestamp` value from the response of the previous request by 1 and use it as the `time_value` in the next request. The maximum time span for a single request is limited to 24 hours.
        - $ref: '#/components/parameters/ResponseFormat'
        - name: extended
          in: query
          required: false
          schema:
            type: boolean
            default: false
          description: When set to true, the response entries include additional enrichment fields.
      description: 'The YARA Matches Feed API returns a recordset of YARA ruleset matches in the requested time range for the authenticated user. The feed will return at most 1000 records, starting from the earliest one. However, if a single second contains more than 1000 matches, all of them will be returned in a single query. If a sample was matched by several rulesets, each will produce its own entry in the response. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      feed:
                        name: YARA Match Continuous Feed
                        time_range:
                          from: Wed, 01 Jan 2025 00:00:00 +0000
                          to: Thu, 02 Jan 2025 00:00:00 +0000
                        last_timestamp: 1735776000
                        entries: []
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              from:
                                type: integer
                              to:
                                type: integer
                          last_timestamp:
                            type: integer
                          entries:
                            type: array
                            items:
                              type: object
                              properties:
                                timestamp:
                                  type: integer
                                sha1:
                                  type: string
                                file_type:
                                  type: string
                                file_size:
                                  type: string
                                ruleset_sha1:
                                  type: string
                                ruleset_name:
                                  type: string
                                rule:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      identifier:
                                        type: string
                                      meta:
                                        type: string
                                      tag:
                                        type: string
                                      matched_data:
                                        type: array
                                        items:
                                          type: object
                                          properties:
                                            string_identifier:
                                              type: string
                                            match_offset:
                                              type: string
                                            matched_string:
                                              type: string
                                sample_available:
                                  type: string
                                md5:
                                  type: string
                                  description: MD5 hash of the file, available when `extended=true`.
                                sha256:
                                  type: string
                                  description: SHA256 hash of the file, available when `extended=true`.
                                first_seen:
                                  type: string
                                  description: Timestamp when the sample was first seen, available when `extended=true`.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: Conflict. The request could not be completed due to a conflict with the current state of the resource.
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            # Basic request (default: extended=false)
            curl --url 'https://data.reversinglabs.com/api/feed/yara/v1/query/timestamp/1463702400?format=json' --user <username>:<password>

            # Extended request with additional metadata (MD5, SHA256, first_seen)
            curl --url 'https://data.reversinglabs.com/api/feed/yara/v1/query/timestamp/1463702400?format=json&extended=true' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            # Default is extended=false. Use extended=true to get additional metadata (MD5, SHA256, first_seen).
            url = "https://data.reversinglabs.com/api/feed/yara/v1/query/timestamp/1463702400?format=json&extended=true"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/ioc/v1/query/{type}/{time_format}/{time_value}/page/{page}:
    get:
      summary: 'TCA-0330: Indicators of Compromise (time range) (paginated)'
      tags:
        - Malware Hunting
      operationId: get-api-ioc-v1-query-time-range-paginated
      description: |
        The Indicators of Compromise (IoC) API retrieves IoC data for a specified time range and paginates the results. The API supports filtering by type (sample or URL), time format (timestamp or UTC), classification, threat level, malware family, malware type, threat actor, sample type, platform, and vertical.
      parameters:
        - name: type
          in: path
          required: true
          schema:
            type: string
            enum:
              - sample
              - URL
          description: |
            Required parameter that specifies the type of IoC to be retrieved (sample or URL).
        - name: time_format
          in: path
          required: true
          schema:
            type: string
            enum:
              - timestamp
              - utc
          description: |
            Required parameter that specifies the time format for the `time_value` parameter.
        - name: time_value
          in: path
          required: true
          schema:
            type: string
            format: date-time
          description: |
            Required parameter that specifies the time range for the data.
        - name: page
          in: path
          required: false
          schema:
            type: string
          description: |
            Optional parameter specifying the page of results to be retrieved. Use the `next_page` value from the response to get the next page of results.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 1000
            minimum: 1
            maximum: 1000
          description: |
            Maximum number of results to be retrieved. Default is 1000.
        - name: classification
          in: query
          required: false
          schema:
            type: string
            enum:
              - malicious
              - suspicious
        - name: threat_level
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 5
        - name: vertical
          in: query
          required: false
          schema:
            type: string
            enum:
              - financial
              - ransomware
              - apt
              - exploit
              - retail
              - bots
              - healthcare
          description: |
            The vertical of the IoC. Applicable only for samples.
        - name: malware_family
          in: query
          required: false
          schema:
            type: string
        - name: malware_type
          in: query
          required: false
          schema:
            type: string
            enum:
              - Infostealer
              - Dropper
              - Spyware
              - Trojan
              - Backdoor
              - Dialer
              - Worm
              - Downloader
              - Keylogger
              - Adware
              - Malware
              - Rogue
              - PUA
              - Packed
              - Exploit
              - Virus
              - Hacktool
              - Browser
              - Network
              - Rootkit
              - Phishing
              - Ransomware
              - Coinminer
              - Spam
          description: Applies only when `type=sample`. For `type=url`, any string value is accepted (e.g., `hyperlink`).
        - name: threat_actor
          in: query
          required: false
          schema:
            type: string
          description: |
            The threat actor associated with the IoC. Applicable only for samples.
        - name: sample_type
          in: query
          required: false
          schema:
            type: string
          description: |
            The type of the sample associated with the IoC. Applicable only for samples.
        - name: platform
          in: query
          required: false
          schema:
            type: string
            enum:
              - ABAP
              - Android
              - AOL
              - Archive
              - Audio
              - Binary
              - Blackberry
              - Boot
              - ByteCode
              - Console
              - Document
              - DOS
              - Email
              - EPOC
              - Firmware
              - FreeBSD
              - Image
              - iOS
              - Linux
              - MacOS
              - Menuet
              - Novell
              - OS2
              - Package
              - Palm
              - Script
              - Shortcut
              - Solaris
              - SunOS
              - Symbian
              - Text
              - Unix
              - Video
              - WebAssembly
              - Win32
              - Win64
              - WinCE
          description: |
            The platform of the IoC. Applicable only for samples.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      query:
                        time_range:
                          to: '2022-01-01T23:59:55Z'
                          from: '2021-12-01T23:59:55Z'
                      entries:
                        - sha1: 801271a14ce7dcad5c0d1cadb590114807ecbc19
                          sha256: d9741b64ee636d6be9dad1594e0b6eb4c749d55749f36518d145554ef7143a2c
                          md5: 83909dcd20bee6eac4848c5c67231edb
                          threat_level: 5
                          malware_family: Plugx
                          malware_type: Backdoor
                          platform: ByteCode
                          threat_name: ByteCode-MSIL.Backdoor.Plugx
                          classification: MALICIOUS
                          sample_type: PE/Exe/IExpress
                          first_seen: '2022-01-01T23:59:55Z'
                          threat_actors:
                            - Emissary Panda
                            - APT 27
                            - TEMP.Hippo
                            - TG-3390
                            - Bronze Union
                            - Group 35
                            - LuckyMouse
                            - Budworm
                            - Earth Smilodon
                            - Iron Tiger
                            - ATK 15
                            - G0027
                          verticals:
                            - ransomware
                          reason: blacklist
                      next_page: 1641083310a45ab18fb7a06dd5ecb44bf6c221a951f974059f
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      query:
                        type: array
                        description: Contains the query parameters used in the request.
                        items:
                          type: object
                          properties:
                            time_range:
                              type: object
                              properties:
                                from:
                                  type: string
                                to:
                                  type: string
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            sha1:
                              type: string
                              description: |
                                Only available for `sample` type.
                            sha256:
                              type: string
                              description: |
                                Only available for `sample` type.
                            md5:
                              type: string
                              description: |
                                Only available for `sample` type.
                            url:
                              type: string
                              description: |
                                Only available for `URL` type.
                            threat_level:
                              type: integer
                            malware_family:
                              type: string
                            malware_type:
                              type: string
                            platform:
                              type: string
                              description: |
                                Only available for `sample` type.
                            threat_name:
                              type: string
                            classification:
                              type: string
                            sample_type:
                              type: string
                              description: |
                                Only available for `sample` type.
                            first_seen:
                              type: string
                            threat_actors:
                              type: string
                              description: |
                                Only available for `sample` type.
                            verticals:
                              type: array
                              uniqueItems: true
                              items:
                                type: string
                                enum:
                                  - financial
                                  - ransomware
                                  - apt
                                  - exploit
                                  - retail
                                  - bots
                                  - healthcare
                              description: |
                                Only available for `sample` type.
                            reason:
                              type: string
                      next_page:
                        type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/ioc/v1/query/url/utc/2025-01-01T10:00:00/page/1641083310a45ab18fb7a06dd5ecb44bf6c221a951f974059f' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/ioc/v1/query/url/utc/2025-01-01T10:00:00/page/1641083310a45ab18fb7a06dd5ecb44bf6c221a951f974059f"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/ioc/v1/query/{type}/{time_format}/{time_value}:
    get:
      summary: 'TCA-0330: Indicators of Compromise (time range)'
      tags:
        - Malware Hunting
      operationId: get-api-ioc-v1-query-time-range
      description: |
        The Indicators of Compromise (IoC) API retrieves IoC data for a specified time range. The API supports filtering by type (sample or URL), time format (timestamp or UTC), classification, threat level, malware family, malware type, threat actor, sample type, platform, and vertical.
      parameters:
        - name: type
          in: path
          required: true
          schema:
            type: string
            enum:
              - sample
              - URL
          description: |
            Required parameter that specifies the type of IoC to be retrieved (sample or URL).
        - name: time_format
          in: path
          required: true
          schema:
            type: string
            enum:
              - timestamp
              - utc
          description: |
            Required parameter that specifies the time format for the `time_value` parameter.
        - name: time_value
          in: path
          required: true
          schema:
            type: string
            format: date-time
          description: |
            Required parameter that specifies the time range for the data.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 1000
            minimum: 1
            maximum: 1000
          description: |
            Maximum number of results to be retrieved. Default is 1000.
        - name: classification
          in: query
          required: false
          schema:
            type: string
            enum:
              - malicious
              - suspicious
        - name: threat_level
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 5
        - name: vertical
          in: query
          required: false
          schema:
            type: string
            enum:
              - financial
              - ransomware
              - apt
              - exploit
              - retail
              - bots
              - healthcare
          description: |
            The vertical of the IoC. Applicable only for samples.
        - name: malware_family
          in: query
          required: false
          schema:
            type: string
        - name: malware_type
          in: query
          required: false
          schema:
            type: string
            enum:
              - Infostealer
              - Dropper
              - Spyware
              - Trojan
              - Backdoor
              - Dialer
              - Worm
              - Downloader
              - Keylogger
              - Adware
              - Malware
              - Rogue
              - PUA
              - Packed
              - Exploit
              - Virus
              - Hacktool
              - Browser
              - Network
              - Rootkit
              - Phishing
              - Ransomware
              - Coinminer
              - Spam
          description: Applies only when `type=sample`. For `type=url`, any string value is accepted (e.g., `hyperlink`).
        - name: threat_actor
          in: query
          required: false
          schema:
            type: string
          description: |
            The threat actor associated with the IoC. Applicable only for samples.
        - name: sample_type
          in: query
          required: false
          schema:
            type: string
          description: |
            The type of the sample associated with the IoC. Applicable only for samples.
        - name: platform
          in: query
          required: false
          schema:
            type: string
            enum:
              - ABAP
              - Android
              - AOL
              - Archive
              - Audio
              - Binary
              - Blackberry
              - Boot
              - ByteCode
              - Console
              - Document
              - DOS
              - Email
              - EPOC
              - Firmware
              - FreeBSD
              - Image
              - iOS
              - Linux
              - MacOS
              - Menuet
              - Novell
              - OS2
              - Package
              - Palm
              - Script
              - Shortcut
              - Solaris
              - SunOS
              - Symbian
              - Text
              - Unix
              - Video
              - WebAssembly
              - Win32
              - Win64
              - WinCE
          description: |
            The platform of the IoC. Applicable only for samples.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      query:
                        time_range:
                          to: '2022-01-01T23:59:55Z'
                          from: '2021-12-01T23:59:55Z'
                      entries:
                        - sha1: 801271a14ce7dcad5c0d1cadb590114807ecbc19
                          sha256: d9741b64ee636d6be9dad1594e0b6eb4c749d55749f36518d145554ef7143a2c
                          md5: 83909dcd20bee6eac4848c5c67231edb
                          threat_level: 5
                          malware_family: Plugx
                          malware_type: Backdoor
                          platform: ByteCode
                          threat_name: ByteCode-MSIL.Backdoor.Plugx
                          classification: MALICIOUS
                          sample_type: PE/Exe/IExpress
                          first_seen: '2022-01-01T23:59:55Z'
                          threat_actors:
                            - Emissary Panda
                            - APT 27
                            - TEMP.Hippo
                            - TG-3390
                            - Bronze Union
                            - Group 35
                            - LuckyMouse
                            - Budworm
                            - Earth Smilodon
                            - Iron Tiger
                            - ATK 15
                            - G0027
                          verticals:
                            - ransomware
                          reason: blacklist
                      next_page: 1641083310a45ab18fb7a06dd5ecb44bf6c221a951f974059f
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      query:
                        type: array
                        description: Contains the query parameters used in the request.
                        items:
                          type: object
                          properties:
                            time_range:
                              type: object
                              properties:
                                from:
                                  type: string
                                to:
                                  type: string
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            sha1:
                              type: string
                              description: |
                                Only available for `sample` type.
                            sha256:
                              type: string
                              description: |
                                Only available for `sample` type.
                            md5:
                              type: string
                              description: |
                                Only available for `sample` type.
                            url:
                              type: string
                              description: |
                                Only available for `URL` type.
                            threat_level:
                              type: integer
                            malware_family:
                              type: string
                            malware_type:
                              type: string
                            platform:
                              type: string
                              description: |
                                Only available for `sample` type.
                            threat_name:
                              type: string
                            classification:
                              type: string
                            sample_type:
                              type: string
                              description: |
                                Only available for `sample` type.
                            first_seen:
                              type: string
                            threat_actors:
                              type: string
                              description: |
                                Only available for `sample` type.
                            verticals:
                              type: array
                              uniqueItems: true
                              items:
                                type: string
                                enum:
                                  - financial
                                  - ransomware
                                  - apt
                                  - exploit
                                  - retail
                                  - bots
                                  - healthcare
                              description: |
                                Only available for `sample` type.
                            reason:
                              type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/ioc/v1/query/url/utc/2025-01-01T10:00:00' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/ioc/v1/query/url/utc/2025-01-01T10:00:00/page/1641083310a45ab18fb7a06dd5ecb44bf6c221a951f974059f"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/ioc/v1/query/{type}/latest/page/{page}:
    get:
      summary: 'TCA-0330: Indicators of Compromise (latest) (paginated)'
      tags:
        - Malware Hunting
      operationId: get-api-ioc-v1-query-latest-page
      description: |
        The Indicators of Compromise (IoC) API retrieves paginated IoC data for the latest available time range. The API supports filtering by type (sample or URL), classification, threat level, malware family, malware type, threat actor, sample type, platform, and vertical.
      parameters:
        - name: type
          in: path
          required: true
          schema:
            type: string
            enum:
              - sample
              - URL
          description: |
            Required parameter that specifies the type of IoC to be retrieved (sample or URL).
        - name: page
          in: path
          required: false
          schema:
            type: string
          description: |
            Optional parameter specifying the page of results to be retrieved. Use the `next_page` value from the response to get the next page of results.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 1000
            minimum: 1
            maximum: 1000
          description: |
            Maximum number of results to be retrieved. Default is 1000.
        - name: classification
          in: query
          required: false
          schema:
            type: string
            enum:
              - malicious
              - suspicious
        - name: threat_level
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 5
        - name: vertical
          in: query
          required: false
          schema:
            type: string
            enum:
              - financial
              - ransomware
              - apt
              - exploit
              - retail
              - bots
              - healthcare
          description: |
            The vertical of the IoC. Applicable only for samples.
        - name: malware_family
          in: query
          required: false
          schema:
            type: string
        - name: malware_type
          in: query
          required: false
          schema:
            type: string
            enum:
              - Infostealer
              - Dropper
              - Spyware
              - Trojan
              - Backdoor
              - Dialer
              - Worm
              - Downloader
              - Keylogger
              - Adware
              - Malware
              - Rogue
              - PUA
              - Packed
              - Exploit
              - Virus
              - Hacktool
              - Browser
              - Network
              - Rootkit
              - Phishing
              - Ransomware
              - Coinminer
              - Spam
          description: Applies only when `type=sample`. For `type=url`, any string value is accepted (e.g., `hyperlink`).
        - name: threat_actor
          in: query
          required: false
          schema:
            type: string
          description: |
            The threat actor associated with the IoC. Applicable only for samples.
        - name: sample_type
          in: query
          required: false
          schema:
            type: string
          description: |
            The type of the sample associated with the IoC. Applicable only for samples.
        - name: platform
          in: query
          required: false
          schema:
            type: string
            enum:
              - ABAP
              - Android
              - AOL
              - Archive
              - Audio
              - Binary
              - Blackberry
              - Boot
              - ByteCode
              - Console
              - Document
              - DOS
              - Email
              - EPOC
              - Firmware
              - FreeBSD
              - Image
              - iOS
              - Linux
              - MacOS
              - Menuet
              - Novell
              - OS2
              - Package
              - Palm
              - Script
              - Shortcut
              - Solaris
              - SunOS
              - Symbian
              - Text
              - Unix
              - Video
              - WebAssembly
              - Win32
              - Win64
              - WinCE
          description: |
            The platform of the IoC. Applicable only for samples.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      query:
                        time_range:
                          to: '2022-01-01T23:59:55Z'
                          from: '2021-12-01T23:59:55Z'
                      entries:
                        - URL: www.malicious-site-danger-danger.com
                          threat_level: 5
                          malware_type: Backdoor
                          classification: MALICIOUS
                          first_seen: '2022-01-01T23:59:55Z'
                          reason: third_party_sources
                      next_page: 1641083310a45ab18fb7a06dd5ecb44bf6c221a951f974059f
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      query:
                        type: array
                        description: Contains the query parameters used in the request.
                        items:
                          type: object
                          properties:
                            time_range:
                              type: object
                              properties:
                                from:
                                  type: string
                                to:
                                  type: string
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            sha1:
                              type: string
                              description: |
                                Only available for `sample` type.
                            sha256:
                              type: string
                              description: |
                                Only available for `sample` type.
                            md5:
                              type: string
                              description: |
                                Only available for `sample` type.
                            url:
                              type: string
                              description: |
                                Only available for `URL` type.
                            threat_level:
                              type: integer
                            malware_family:
                              type: string
                            malware_type:
                              type: string
                            platform:
                              type: string
                              description: |
                                Only available for `sample` type.
                            threat_name:
                              type: string
                            classification:
                              type: string
                            sample_type:
                              type: string
                              description: |
                                Only available for `sample` type.
                            first_seen:
                              type: string
                            threat_actors:
                              type: string
                              description: |
                                Only available for `sample` type.
                            verticals:
                              type: array
                              uniqueItems: true
                              items:
                                type: string
                                enum:
                                  - financial
                                  - ransomware
                                  - apt
                                  - exploit
                                  - retail
                                  - bots
                                  - healthcare
                              description: |
                                Only available for `sample` type.
                            reason:
                              type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/ioc/v1/query/url/latest/page/1641083310a45ab18fb7a06dd5ecb44bf6c221a951f974059f' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/ioc/v1/query/url/latest/page/1641083310a45ab18fb7a06dd5ecb44bf6c221a951f974059f"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/ioc/v1/query/{type}/latest:
    get:
      summary: 'TCA-0330: Indicators of Compromise (latest)'
      tags:
        - Malware Hunting
      operationId: get-api-ioc-v1-query-latest
      description: |
        The Indicators of Compromise (IoC) API retrieves the latest IoC data. The API supports filtering by type (sample or URL), classification, threat level, malware family, malware type, threat actor, sample type, platform, and vertical.
      parameters:
        - name: type
          in: path
          required: true
          schema:
            type: string
            enum:
              - sample
              - URL
          description: |
            Required parameter that specifies the type of IoC to be retrieved (sample or URL).
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 1000
            minimum: 1
            maximum: 1000
          description: |
            Maximum number of results to be retrieved. Default is 1000.
        - name: classification
          in: query
          required: false
          schema:
            type: string
            enum:
              - malicious
              - suspicious
        - name: threat_level
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 5
        - name: vertical
          in: query
          required: false
          schema:
            type: string
            enum:
              - financial
              - ransomware
              - apt
              - exploit
              - retail
              - bots
              - healthcare
          description: |
            The vertical of the IoC. Applicable only for samples.
        - name: malware_family
          in: query
          required: false
          schema:
            type: string
        - name: malware_type
          in: query
          required: false
          schema:
            type: string
            enum:
              - Infostealer
              - Dropper
              - Spyware
              - Trojan
              - Backdoor
              - Dialer
              - Worm
              - Downloader
              - Keylogger
              - Adware
              - Malware
              - Rogue
              - PUA
              - Packed
              - Exploit
              - Virus
              - Hacktool
              - Browser
              - Network
              - Rootkit
              - Phishing
              - Ransomware
              - Coinminer
              - Spam
          description: Applies only when `type=sample`. For `type=url`, any string value is accepted (e.g., `hyperlink`).
        - name: threat_actor
          in: query
          required: false
          schema:
            type: string
          description: |
            The threat actor associated with the IoC. Applicable only for samples.
        - name: sample_type
          in: query
          required: false
          schema:
            type: string
          description: |
            The type of the sample associated with the IoC. Applicable only for samples.
        - name: platform
          in: query
          required: false
          schema:
            type: string
            enum:
              - ABAP
              - Android
              - AOL
              - Archive
              - Audio
              - Binary
              - Blackberry
              - Boot
              - ByteCode
              - Console
              - Document
              - DOS
              - Email
              - EPOC
              - Firmware
              - FreeBSD
              - Image
              - iOS
              - Linux
              - MacOS
              - Menuet
              - Novell
              - OS2
              - Package
              - Palm
              - Script
              - Shortcut
              - Solaris
              - SunOS
              - Symbian
              - Text
              - Unix
              - Video
              - WebAssembly
              - Win32
              - Win64
              - WinCE
          description: |
            The platform of the IoC. Applicable only for samples.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      query:
                        time_range:
                          to: '2022-01-01T23:59:55Z'
                          from: '2021-12-01T23:59:55Z'
                      entries:
                        - URL: www.malicious-site-danger-danger.com
                          threat_level: 5
                          malware_type: Backdoor
                          classification: MALICIOUS
                          first_seen: '2022-01-01T23:59:55Z'
                          reason: third_party_sources
                      next_page: 1641083310a45ab18fb7a06dd5ecb44bf6c221a951f974059f
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      query:
                        type: array
                        description: Contains the query parameters used in the request.
                        items:
                          type: object
                          properties:
                            time_range:
                              type: object
                              properties:
                                from:
                                  type: string
                                to:
                                  type: string
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            sha1:
                              type: string
                              description: |
                                Only available for `sample` type.
                            sha256:
                              type: string
                              description: |
                                Only available for `sample` type.
                            md5:
                              type: string
                              description: |
                                Only available for `sample` type.
                            threat_level:
                              type: integer
                            malware_family:
                              type: string
                            malware_type:
                              type: string
                            platform:
                              type: string
                              description: |
                                Only available for `sample` type.
                            threat_name:
                              type: string
                            classification:
                              type: string
                            sample_type:
                              type: string
                              description: |
                                Only available for `sample` type.
                            first_seen:
                              type: string
                            threat_actors:
                              type: string
                              description: |
                                Only available for `sample` type.
                            verticals:
                              type: array
                              uniqueItems: true
                              items:
                                type: string
                                enum:
                                  - financial
                                  - ransomware
                                  - apt
                                  - exploit
                                  - retail
                                  - bots
                                  - healthcare
                              description: |
                                Only available for `sample` type.
                            reason:
                              type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/ioc/v1/query/url/latest' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/ioc/v1/query/url/latest"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/ioc/v1/query/{type}/{time_format}/{time_value}/summary:
    get:
      summary: 'TCA-0330: Indicators of Compromise Summary'
      tags:
        - Malware Hunting
      operationId: get-api-ioc-v1-query-summary
      description: |
        The Indicators of Compromise (IoC) Summary API retrieves summary statistics for IoC data based on the specified time range. The API supports filtering by type (sample or URL), time format (timestamp or UTC), classification, threat level, malware family, malware type, threat actor, sample type, platform, and vertical.
      parameters:
        - name: type
          in: path
          required: true
          schema:
            type: string
            enum:
              - sample
              - URL
          description: |
            Required parameter that specifies the type of IoC to be retrieved (sample or URL).
        - name: time_format
          in: path
          required: true
          schema:
            type: string
            enum:
              - timestamp
              - utc
          description: |
            Required parameter that specifies the time format for the `time_value` parameter.
        - name: time_value
          in: path
          required: true
          schema:
            type: string
            format: date-time
          description: |
            Required parameter that specifies the time range for the data.
        - name: classification
          in: query
          required: false
          schema:
            type: string
            enum:
              - malicious
              - suspicious
        - name: threat_level
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 5
        - name: vertical
          in: query
          required: false
          schema:
            type: string
            enum:
              - financial
              - ransomware
              - apt
              - exploit
              - retail
              - bots
              - healthcare
          description: |
            The vertical of the IoC. Applicable only for samples.
        - name: malware_family
          in: query
          required: false
          schema:
            type: string
        - name: malware_type
          in: query
          required: false
          schema:
            type: string
            enum:
              - Infostealer
              - Dropper
              - Spyware
              - Trojan
              - Backdoor
              - Dialer
              - Worm
              - Downloader
              - Keylogger
              - Adware
              - Malware
              - Rogue
              - PUA
              - Packed
              - Exploit
              - Virus
              - Hacktool
              - Browser
              - Network
              - Rootkit
              - Phishing
              - Ransomware
              - Coinminer
              - Spam
          description: Applies only when `type=sample`. For `type=url`, any string value is accepted (e.g., `hyperlink`).
        - name: threat_actor
          in: query
          required: false
          schema:
            type: string
          description: |
            The threat actor associated with the IoC. Applicable only for samples.
        - name: sample_type
          in: query
          required: false
          schema:
            type: string
          description: |
            The type of the sample associated with the IoC. Applicable only for samples.
        - name: platform
          in: query
          required: false
          schema:
            type: string
            enum:
              - ABAP
              - Android
              - AOL
              - Archive
              - Audio
              - Binary
              - Blackberry
              - Boot
              - ByteCode
              - Console
              - Document
              - DOS
              - Email
              - EPOC
              - Firmware
              - FreeBSD
              - Image
              - iOS
              - Linux
              - MacOS
              - Menuet
              - Novell
              - OS2
              - Package
              - Palm
              - Script
              - Shortcut
              - Solaris
              - SunOS
              - Symbian
              - Text
              - Unix
              - Video
              - WebAssembly
              - Win32
              - Win64
              - WinCE
          description: |
            The platform of the IoC. Applicable only for samples.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      query:
                        time_range:
                          to: '2022-01-01T23:59:55Z'
                          from: '2021-10-01T23:59:55Z'
                      entries_count: 23049
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      query:
                        type: array
                        description: Contains the query parameters used in the request.
                        items:
                          type: object
                          properties:
                            time_range:
                              type: object
                              properties:
                                from:
                                  type: string
                                to:
                                  type: string
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            sha1:
                              type: string
                              description: |
                                Only available for `sample` type.
                            sha256:
                              type: string
                              description: |
                                Only available for `sample` type.
                            md5:
                              type: string
                              description: |
                                Only available for `sample` type.
                            url:
                              type: string
                              description: |
                                Only available for `URL` type.
                            threat_level:
                              type: integer
                            malware_family:
                              type: string
                            malware_type:
                              type: string
                            platform:
                              type: string
                              description: |
                                Only available for `sample` type.
                            threat_name:
                              type: string
                            classification:
                              type: string
                            sample_type:
                              type: string
                              description: |
                                Only available for `sample` type.
                            first_seen:
                              type: string
                            threat_actors:
                              type: string
                              description: |
                                Only available for `sample` type.
                            verticals:
                              type: array
                              uniqueItems: true
                              items:
                                type: string
                                enum:
                                  - financial
                                  - ransomware
                                  - apt
                                  - exploit
                                  - retail
                                  - bots
                                  - healthcare
                              description: |
                                Only available for `sample` type.
                            reason:
                              type: string
                      entries_count:
                        type: integer
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/ioc/v1/query/sample/utc/2025-01-01T10:00:00/summary' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/ioc/v1/query/sample/utc/2025-01-01T10:00:00/summary"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/feed/malware/detection/family/v2/statistics/category/{category}/{filter}:
    get:
      summary: 'TCA-0307-0311, 0317: Vertical Feeds Statistics'
      tags:
        - Malware Hunting
      operationId: get-feed-malware-detection-family-v2-statistics-category
      parameters:
        - name: category
          in: path
          required: true
          schema:
            type: string
            enum:
              - financial
              - retail
              - ransomware
              - apt
              - exploit
              - configuration
          description: Required parameter that corresponds to the vertical feed category the user is requesting to access. Only one category can be requested in each query. Note that the response for the `exploit` category contains additional `scanner_coverage` data not found in other categories.
        - name: filter
          in: path
          required: true
          schema:
            type: string
            enum:
              - first_seen
              - counts
              - top_list
          description: |
            - `first_seen`: list of family names newly added to the requested category, and the times when they were added
            - `counts`: number of unique new samples added for each malware family in the requested category
            - `top_list`: top 20 family names and their unique hash counts for the requested category
        - name: weeks
          in: query
          schema:
            type: integer
            minimum: 0
            maximum: 30
            default: 0
            example: 2
          description: Optional parameter that specifies the number of weeks for which the data will be returned in the response. When the parameter is not included in the request, all available data is returned. The same happens when setting the `weeks` value to zero, using the `all_time` parameter instead, or omitting both `weeks` and `all_time` from the request altogether. **When this parameter is used in the query, all_time cannot be used in the same request.**
        - name: all_time
          in: query
          schema:
            type: boolean
          allowEmptyValue: true
          description: Optional flag parameter that instructs the service to return all available data for the requested category. The same happens when the `weeks` value is set to zero. When neither this parameter nor the `weeks` parameter are included in the request, all available data is returned by default. **When this parameter is used in the query, weeks cannot be used in the same request.**
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The Vertical Feeds Statistics API provides information about new malware samples detected in Spectra Intelligence, filtered by category. The service can return a list of malware family names newly added to each category; the number of unique new samples added for each malware family in a category; and a list of top 20 malware families per category. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      feed:
                        name: Verticals Statistics First Seen
                        entries:
                          - category: apt
                            all_time: true
                            entries:
                              - first_seen: '2017-01-13 09:40:07'
                                family_name: Adwind
                              - first_seen: '2017-01-24 00:01:13'
                                family_name: AgentXST
                              - first_seen: '2017-02-28 20:01:23'
                                family_name: Agentdne
                              - first_seen: '2017-01-13 09:36:34'
                                family_name: Autorun
                              - first_seen: '2017-01-14 15:09:51'
                                family_name: BADNEWS
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          name:
                            type: string
                          entries:
                            type: array
                            items:
                              type: object
                              properties:
                                category:
                                  type: string
                                all_time:
                                  type: boolean
                                entries:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      count:
                                        type: integer
                                      family_name:
                                        type: string
                                      first_seen:
                                        type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/feed/malware/detection/family/v2/statistics/category/financial/first_seen?weeks=2&format=json' --user <username>:<password>
        - lang: Python
          label: Python for /top_list
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/feed/malware/detection/family/v2/statistics/category/financial/top_list?format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/feed/malware/detection/family/v2/index/family_name/search/{family_name}/from/{time_format}/{time_value}:
    get:
      summary: 'TCA-0312-0316, TCA-0318: Vertical Feeds Search (time range)'
      tags:
        - Malware Hunting
      operationId: get-feed-vertical-search
      parameters:
        - name: family_name
          in: path
          required: true
          schema:
            type: string
          description: Case-sensitive parameter; accepts a malware family name or a CVE identifier.
        - $ref: '#/components/parameters/TimeFormat'
        - name: time_value
          in: path
          required: true
          schema:
            type: string
            format: Unix timestamp OR date-time
          description: Accepts values formatted according to the format set in the time_format parameter. The latest allowed time value is 60 seconds before the current time.
        - name: count
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
            default: 100
          description: Optional parameter that specifies the number of hashes to return in the response. Setting this value too low may result in identical `from` and `to` timestamps, which will cause a response loop.
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The Vertical Feeds Search API allows users to get hashes of new malware samples from ReversingLabs Targeted and Industry-Specific File Indicator Feeds by searching for malware family names. Samples are included in the response based on the time when they were added to a particular feed. The results include additional metadata about each sample. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      feed:
                        name: Malware Detection Family Feed
                        time_range:
                          from: 1489968000
                          to: 1490747180
                        entries:
                          - record_on: 1489982689
                            sha1: dede1c573a4279ae9465e5e7fdf1d5a8445780fe
                            priority: 5
                            family_name: Stuxnet
                            sample_available: true
                            container_hash: dede1c573a4279ae9465e5e7fdf1d5a8445780fe
                            sha256: 86be74f51dfea0f4ef3f3a17fcd731014295a311003aa7e0bf95fdda8cda5afe
                            md5: 0833efc50a2ff6321fb6a05c73a71e15
                            sample_size: 122880
                            sample_type: PE/Exe
                            first_seen_on: 1489981980
                            last_seen_on: 1489981980
                            tags:
                              actors:
                                - Equation Group
                                - Tilded Team
                                - Unit 8200
                                - EQGRP
                          - record_on: 1490030360
                            sha1: 9aadf6f3a7fa2453f2e5fe2da0696b4c11dad825
                            priority: 5
                            family_name: Stuxnet
                            sample_available: true
                            container_hash: 9aadf6f3a7fa2453f2e5fe2da0696b4c11dad825
                            sha256: 173b06087f8849672359a6ff9895af6715c2ac347718163fdd89ee901d5f6a71
                            md5: 435e6fd45e91c9f9c268e7f111721f60
                            sample_size: 2164423
                            sample_type: Binary/Archive/RAR
                            first_seen_on: 1450349972
                            last_seen_on: 1490030280
                            tags:
                              actors:
                                - Equation Group
                                - Tilded Team
                                - Unit 8200
                                - EQGRP
                          - ...
                        family_name: Stuxnet
                        categories:
                          - apt
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              from:
                                type: integer
                              to:
                                type: integer
                          family_name:
                            type: string
                          categories:
                            type: array
                            items:
                              type: string
                          entries:
                            type: array
                            items:
                              type: object
                              properties:
                                record_on:
                                  type: integer
                                sha1:
                                  type: string
                                priority:
                                  type: integer
                                family_name:
                                  type: string
                                sample_available:
                                  type: boolean
                                container_hash:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                                sample_size:
                                  type: integer
                                sample_type:
                                  type: string
                                first_seen_on:
                                  type: integer
                                last_seen_on:
                                  type: integer
                                tags:
                                  type: object
                                  properties:
                                    actors:
                                      type: array
                                      items:
                                        type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/feed/malware/detection/family/v2/index/family_name/search/Stuxnet/from/utc/2025-01-01T00:00:00?count=20&format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/feed/malware/detection/family/v2/index/family_name/search/Stuxnet/from/utc/2025-01-01T00:00:00?count=20&format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/feed/malware/detection/family/v2/index/family_name/search/{family_name}/latest:
    get:
      summary: 'TCA-0312-0316, TCA-0318: Vertical Feeds Search (latest)'
      tags:
        - Malware Hunting
      operationId: get-feed-vertical-search-latest
      parameters:
        - name: family_name
          in: path
          required: true
          schema:
            type: string
          description: Case-sensitive parameter; accepts a malware family name or a CVE identifier.
        - name: count
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
            default: 100
          description: Optional parameter that specifies the number of hashes to return in the response. Setting this value too low may result in identical `from` and `to` timestamps, which will cause a response loop.
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The Vertical Feeds Search API allows users to get hashes of new malware samples from ReversingLabs Targeted and Industry-Specific File Indicator Feeds by searching for malware family names. Samples are included in the response based on the time when they were added to a particular feed. The results include additional metadata about each sample. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      feed:
                        name: Malware Detection Family Feed
                        time_range:
                          from: 1738205406
                          to: 1738227058
                        family_name: Emotet
                        categories:
                          - financial
                          - configuration
                        entries:
                          - record_on: 1738226987
                            sha1: dd44e75794b3491b8684be02880083f0302e2391
                            priority: 5
                            family_name: Emotet
                            sample_available: true
                            container_hash: dd44e75794b3491b8684be02880083f0302e2391
                            sha256: 9ad1c74cd49a437f01bbe02dfe1bb09015d276b5dcd69d71a9f228be4f281c72
                            md5: fda93af5d031805934fed7f3334aae4f
                            sample_size: 213048
                            sample_type: PE/Exe
                            first_seen_on: 1738225782
                            last_seen_on: 1738226976
                            tags:
                              actors:
                                - Mummy Spider
                                - Gold Crestwood
                                - Mealybug
                                - TA542
                          - record_on: 1738226720
                            sha1: f0d7a0710c78fe6fcc12c0c0e4e47c346bf2fee4
                            priority: 5
                            family_name: Emotet
                            sample_available: true
                            container_hash: d6c8909722a495585e320eab7193322bbb3762fe
                            sha256: 8119217c92c23f0cc2774275eeeb3aef3c6d6c1b0c01993b5633c323a3bc5533
                            md5: 72bf15851c2e2c06a2cb408d0ef2a117
                            sample_size: 56221
                            sample_type: PE/Exe
                            first_seen_on: 1307094420
                            last_seen_on: 1738226707
                            tags:
                              actors:
                                - Mummy Spider
                                - Gold Crestwood
                                - Mealybug
                                - TA542
                          - record_on: 1738226464
                            sha1: f5d55bc9b0df6491f6439631addfd274559e2089
                            priority: 5
                            family_name: Emotet
                            sample_available: true
                            container_hash: f5d55bc9b0df6491f6439631addfd274559e2089
                            sha256: 6f24827cea4f555f5b7ab3ff1b54a01b619f196d86ee3a0cced4ef4242e84563
                            md5: eeaf2b2952bfe1ccacc94f27d494e5f5
                            sample_size: 277808
                            sample_type: PE/Exe
                            first_seen_on: 1738225513
                            last_seen_on: 1738226462
                            tags:
                              actors:
                                - Mummy Spider
                                - Gold Crestwood
                                - Mealybug
                                - TA542
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              from:
                                type: integer
                              to:
                                type: integer
                          family_name:
                            type: string
                          categories:
                            type: array
                            items:
                              type: string
                          entries:
                            type: array
                            items:
                              type: object
                              properties:
                                record_on:
                                  type: integer
                                sha1:
                                  type: string
                                priority:
                                  type: integer
                                family_name:
                                  type: string
                                sample_available:
                                  type: boolean
                                container_hash:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                                sample_size:
                                  type: integer
                                sample_type:
                                  type: string
                                first_seen_on:
                                  type: integer
                                last_seen_on:
                                  type: integer
                                tags:
                                  type: object
                                  properties:
                                    actors:
                                      type: array
                                      items:
                                        type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/feed/malware/detection/family/v2/index/family_name/search/Stuxnet/from/utc/2025-1-1T00:00:00?count=20&format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/feed/malware/detection/family/v2/index/family_name/search/Stuxnet/from/utc/2025-1-1T00:00:00?count=20&format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - schema:
          type: string
        name: family_name
        in: path
        required: true
  /api/yara/admin/v1/ruleset/start-retro-hunt:
    post:
      summary: 'TCA-0319: Start YARA Retro Hunt'
      tags:
        - Malware Hunting
      operationId: start-retro-hunt
      description: 'The YARA Retro Hunting Administration API allows users to manage their own YARA retro hunts and retroactively match YARA rules against files from ReversingLabs Spectra Intelligence. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    ruleset_name: ExampleRulesetName
                    ruleset_sha1: e6ce17a970bf377fd1963e903316962fc2a7a2b0
              schema:
                type: object
                properties:
                  ruleset_name:
                    type: string
                  ruleset_sha1:
                    type: string
        '201':
          description: Created. The request has been fulfilled, resulting in the creation of a new resource.
        '400':
          description: Bad Request. The received request was malformed and cannot be processed.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The ruleset with *ruleset_name* does not exist for the authenticated user.
        '409':
          description: Conflict. Retro hunt for the ruleset with *ruleset_name* has already been started.
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          label: cURL for start-retro-hunt
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/yara/admin/v1/ruleset/start-retro-hunt' --header 'Content-Type: application/json' --data '{"ruleset_name": "ExampleRulesetName"}' --user <username>:<password>
        - lang: Python
          label: Cancel the retro hunt
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/yara/admin/v1/ruleset/start-retro-hunt"

            json = {
              "ruleset_name": "ExampleRulesetName"
            }

            headers = {
              'Content-Type': 'application/json'
            }

            response = requests.post(url, headers=headers, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - ruleset_name
              properties:
                ruleset_name:
                  type: string
                  minLength: 3
                  maxLength: 48
                  pattern: ^[a-z,A-Z,0-9,_-]*$
                  example: ExampleRulesetName
        description: '`ruleset_name` is a required parameter that specifies the name of the YARA ruleset for which the user is requesting an action from the service. The value must be a string containing the name of a YARA ruleset previously uploaded by the user. Only one ruleset name can be submitted in each request.'
  /api/yara/admin/v1/ruleset/cancel-retro-hunt:
    post:
      summary: 'TCA-0319: Cancel YARA Retro Hunt'
      tags:
        - Malware Hunting
      operationId: cancel-retro-hunt
      description: 'The YARA Retro Hunting Administration API allows users to manage their own YARA retro hunts and retroactively match YARA rules against files from ReversingLabs Spectra Intelligence. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    ruleset_name: ExampleRulesetName
                    ruleset_sha1: e6ce17a970bf377fd1963e903316962fc2a7a2b0
              schema:
                type: object
                properties:
                  ruleset_name:
                    type: string
                  ruleset_sha1:
                    type: string
        '201':
          description: Created. The request has been fulfilled, resulting in the creation of a new resource.
        '400':
          description: Bad Request. The received request was malformed and cannot be processed.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The ruleset with *ruleset_name* does not exist for the authenticated user.
        '409':
          description: Conflict. Retro hunt for the ruleset with *ruleset_name* has already been started.
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          label: cURL for start-retro-hunt
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/yara/admin/v1/ruleset/start-retro-hunt' --header 'content-type: application/json' --data '{"ruleset_name" : "ExampleRulesetName"}' --user <username>:<password>
        - lang: Python
          label: Cancel the retro hunt
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/yara/admin/v1/ruleset/cancel-retro-hunt"

            json = {
              "ruleset_name": "ExampleRulesetName"
            }

            headers = {
              'Accept': 'application/json',
            }

            response = requests.post(url, headers=headers, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - ruleset_name
              properties:
                ruleset_name:
                  type: string
                  minLength: 3
                  maxLength: 48
                  pattern: ^[a-z,A-Z,0-9,_-]*$
                  example: ExampleRulesetName
        description: '`ruleset_name` is a required parameter that specifies the name of the YARA ruleset for which the user is requesting an action from the service. The value must be a string containing the name of a YARA ruleset previously uploaded by the user. Only one ruleset name can be submitted in each request.'
  /api/yara/admin/v1/ruleset/{ruleset_name}/status-retro-hunt:
    get:
      summary: 'TCA-0319: YARA Retro Hunting Status'
      tags:
        - Malware Hunting
      operationId: get-api-yara-retro-admin-v1-ruleset-ruleset_name-status-retro-hunt
      description: 'The YARA Retro Hunting Administration API allows users to manage their own YARA retro hunts and retroactively match YARA rules against files from ReversingLabs Spectra Intelligence. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    retro_status: CANCELLED
                    reason: null
                    progress: null
                    start_time: '2025-01-16T08:34:43'
                    estimated_finish_time: null
                    finish_time: null
                    ruleset_name: ExampleRulesetName
              schema:
                type: object
                properties:
                  ruleset_name:
                    type: string
                  retro_status:
                    type: string
                  reason:
                    type: string
                  progress:
                    type: string
                  start_time:
                    type: string
                  finish_time:
                    type: string
                  estimated_finish_time:
                    type: string
        '201':
          description: Created. The request has been fulfilled, resulting in the creation of a new resource.
        '400':
          description: Bad Request. The received request was malformed and cannot be processed.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The ruleset with *ruleset_name* does not exist for the authenticated user.
        '409':
          description: Conflict. Retro hunt for the ruleset with *ruleset_name* has already been started.
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/yara/admin/v1/ruleset/ExampleRulesetName/status-retro-hunt' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/yara/admin/v1/ruleset/ExampleRulesetName/status-retro-hunt"

            headers = {
              'Content-Type': 'application/json'
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - name: ruleset_name
        in: path
        required: true
        schema:
          type: string
          minLength: 3
          maxLength: 48
          pattern: ^[a-z,A-Z,0-9,_-]*$
          example: RAT_Ratdecoders
        description: Required parameter used for checking the retro hunt status for the specified YARA ruleset. Only one ruleset name can be submitted in each request.
  /api/feed/yara/retro/v1/query/{time_format}/{time_value}:
    get:
      summary: 'TCA-0319: YARA Retro Matches Feed'
      tags:
        - Malware Hunting
      operationId: get-api-feed-yara-retro-v1-query-time_format-time_value
      parameters:
        - $ref: '#/components/parameters/TimeFormat'
        - name: time_value
          in: path
          required: true
          schema:
            type: string
          description: Period between the time specified by this parameter and the time when the request is made. The earliest supported time value is May 20 2016 00:00h UTC (timestamp 1463702400). The latest supported time value is 10 seconds before the current time. The value must be in the format specified by the `time_format` parameter. To get the next page of results, use the `last_timestamp` value from the response of the previous request as the `time_value` in the next request. The maximum time span for a single request is limited to 24 hours.
        - $ref: '#/components/parameters/ResponseFormat'
        - name: extended
          in: query
          required: false
          schema:
            type: boolean
            default: false
          description: When set to true, the response entries include additional enrichment fields.
      description: 'The YARA Retro Matches Feed API returns a recordset of YARA ruleset matches in the requested time range for the authenticated user. The feed will return at most 1000 records, starting from the earliest one. However, if a single second contains more than 1000 matches, all of them will be returned in a single query. When a ruleset reaches 10 000 matches, it will be capped and will no longer store new matches. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      feed:
                        name: YARA Retro Match Continuous Feed
                        time_range:
                          from: Fri, 20 May 2016 00:00:00 +0000
                          to: Sat, 21 May 2016 00:00:00 +0000
                        last_timestamp: 1463788800
                        entries: []
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              from:
                                type: integer
                              to:
                                type: integer
                          last_timestamp:
                            type: integer
                          entries:
                            type: array
                            items:
                              type: object
                              properties:
                                timestamp:
                                  type: integer
                                sha1:
                                  type: string
                                file_type:
                                  type: string
                                file_size:
                                  type: string
                                ruleset_sha1:
                                  type: string
                                ruleset_name:
                                  type: string
                                rule:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      identifier:
                                        type: string
                                      meta:
                                        type: string
                                      tag:
                                        type: string
                                      matched_data:
                                        type: array
                                        items:
                                          type: object
                                          properties:
                                            string_identifier:
                                              type: string
                                            match_offset:
                                              type: string
                                            matched_string:
                                              type: string
                                sample_available:
                                  type: string
                                md5:
                                  type: string
                                  description: MD5 hash of the file, available when `extended=true`.
                                sha256:
                                  type: string
                                  description: SHA256 hash of the file, available when `extended=true`.
                                first_seen:
                                  type: string
                                  description: Timestamp when the sample was first seen, available when `extended=true`.
        '201':
          description: Created. The request has been fulfilled, resulting in the creation of a new resource.
        '400':
          description: Bad Request. The received request was malformed and cannot be processed.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Not Found. The ruleset with *ruleset_name* does not exist for the authenticated user.
        '409':
          description: Conflict. Retro hunt for the ruleset with *ruleset_name* has already been started.
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            # Basic request (default: extended=false)
            curl --url 'https://data.reversinglabs.com/api/feed/yara/retro/v1/query/timestamp/1463702400?format=json' --user <username>:<password>

            # Extended request with additional metadata (MD5, SHA256, first_seen)
            curl --url 'https://data.reversinglabs.com/api/feed/yara/retro/v1/query/timestamp/1463702400?format=json&extended=true' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            # Default is extended=false. Use extended=true to get additional metadata (MD5, SHA256, first_seen).
            url = "https://data.reversinglabs.com/api/feed/yara/retro/v1/query/timestamp/1463702400?format=json&extended=true"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/search/v1/query:
    post:
      summary: 'TCA-0320: Advanced Search'
      tags:
        - Malware Hunting
      operationId: post-api-search-v1-query
      description: 'The Advanced Search API allows users to find samples in ReversingLabs Spectra Intelligence by combining various search keywords. Some queries can be performed without using search keywords (non-keyword search), and bulk hash lookup is supported for hash-related keywords. The search is performed on a static data set that is updated daily. If no records are available for the requested search query, an empty response is returned. Note that the API implements limitations as to how many samples can be returned for a search query in one request and in total. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      web_search_api:
                        sample_count: 100
                        total_count: 380000
                        next_page: 3
                        more_pages: true
                        entries:
                          - sha1: 9b8d2ff9397feb13bd2de190baba590ea63a3631
                            sha256: 3b97ef33994b56e9f89fd288c93e1399eed0a1fefb2359009ad4f781aec4e2d2
                            md5: 9cb2fb9074a39339ccfbf29baee5c062
                            filecount: 0
                            trustfactor: 5
                            threatlevel: 5
                            threatname: Win32.Worm.Ramnit
                            classification: MALICIOUS
                            sampletype: PE/Dll
                            size: 409600
                            available: false
                            lastseen: '2021-11-19T08:50:28Z'
                            firstseen: '2017-06-20T22:55:20Z'
                            antivirus: 18
                          - sha1: 8efd9fa36cf96424ac039fcfc27e3532401a8141
                            sha256: 9f1cb0242b3838c21297d1a1a6d154d3bf2e4f448b53f71b519ea2811445a930
                            md5: ba84c5880b4c342df46fd13fdcf2eb65
                            filecount: 0
                            trustfactor: 5
                            threatlevel: 5
                            threatname: Win32.Worm.Ramnit
                            classification: MALICIOUS
                            sampletype: PE/Dll
                            size: 155489
                            available: false
                            lastseen: '2021-11-18T21:54:34Z'
                            firstseen: '2017-06-20T22:54:59Z'
                            antivirus: 15
                          - sha1: 3b51f678cb32306f0ecf5eae315b07a656ef030e
                            sha256: 4bdefebda4f84321f93797b906641f6817393a079cbb2b0f4ac6219e694ef878
                            md5: 82ab2075a6759d10e520caa2378a0788
                            filecount: 0
                            trustfactor: 5
                            threatlevel: 5
                            threatname: Win32.Worm.Ramnit
                            classification: MALICIOUS
                            sampletype: PE/Exe
                            size: 3040256
                            available: false
                            lastseen: '2023-09-08T15:48:01Z'
                            firstseen: '2017-06-20T22:54:34Z'
                            antivirus: 21
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      web_search_api:
                        type: object
                        properties:
                          more_pages:
                            type: boolean
                          total_count:
                            type: integer
                          next_page:
                            type: integer
                          sample_count:
                            type: integer
                          entries:
                            type: array
                            items:
                              type: object
                              properties:
                                available:
                                  type: boolean
                                sha1:
                                  type: string
                                classification:
                                  type: string
                                threatname:
                                  type: string
                                sampletype:
                                  type: string
                                antivirus:
                                  type: integer
                                firstseen:
                                  type: string
                                lastseen:
                                  type: string
                                trustfactor:
                                  type: integer
                                filecount:
                                  type: integer
                                threatlevel:
                                  type: integer
                                sha256:
                                  type: string
                                md5:
                                  type: string
                                size:
                                  type: integer
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '408':
          description: Request Timeout. The server did not receive a complete request message within the time that it was prepared to wait.
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/search/v1/query' --header 'Content-Type: application/json' --data '{
                "query":[
                   {
                      "name":"firstseen",
                      "criteria":"range",
                      "value":{
                         "from":"2022-01-01T00:00:00Z",
                         "to":"2022-01-02T00:00:00Z"
                      }
                   },
                   {
                      "name":"classification",
                      "criteria":"in",
                      "value":[
                         "malicious",
                         "suspicious"
                      ]
                   },
                   {
                      "name":"threatname",
                      "criteria":"eq",
                      "value":"Win32"
                   }
                ],
                "format":"json",
                "records_per_page":100
             }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/search/v1/query"

            json = {
                "query":[
                   {
                      "name":"firstseen",
                      "criteria":"range",
                      "value":{
                         "from":"2022-01-01T00:00:00Z",
                         "to":"2022-01-02T00:00:00Z"
                      }
                   },
                   {
                      "name":"threatlevel",
                      "criteria":"range",
                      "value":{
                         "from": 4,
                         "to": 5
                      }
                   }
                ]
             }

            headers = {
              'Accept': 'application/json',
            }

            response = requests.post(url, headers=headers, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - query
              properties:
                query:
                  oneOf:
                    - type: string
                      description: 'Every search expression must contain at least one keyword and one criterion. Search expressions are built according to the following formula: field_name:field_value. Example: `firstseen:2018-01-01T00:00:00Z AND classification:malicious`.'
                    - type: object
                      properties:
                        name:
                          type: string
                          description: Field name
                        criteria:
                          type: string
                          enum:
                            - eq
                            - neq
                            - gt
                            - gte
                            - lt
                            - lte
                            - range
                            - in
                            - nin
                        value:
                          oneOf:
                            - type: string
                              description: Value against which the parameter is tested. Depends on the criteria field.
                            - type: object
                      required:
                        - name
                        - criteria
                        - value
                page:
                  type: integer
                  default: 1
                records_per_page:
                  type: integer
                  default: 10000
                format:
                  type: string
                  enum:
                    - xml
                    - json
                  default: xml
                  description: Specifies the format for the response.
                sort:
                  type: string
                  default: firstseen desc
                  description: 'Sort by one of these fields: `sha1, firstseen, threatname, sampletype, filecount, size`. Append `asc` for ascending and `desc` for descending order, e.g. `threatname asc`.'
            examples:
              JSON Request Example for a String Query:
                value:
                  query: firstseen:[2017-06-20T00:00:00Z TO 2017-06-21T00:00:00Z] classification:[malicious, suspicious] threatname:win32
                  page: 2
                  format: json
                  records_per_page: 100
                  sort: threatname desc
              JSON Request Example for a JSON Query:
                value:
                  query:
                    - name: firstseen
                      criteria: range
                      value:
                        from: '2017-06-20T00:00:00Z'
                        to: '2017-06-21T00:00:00Z'
                    - name: classification
                      criteria: in
                      value:
                        - malicious
                        - suspicious
                    - name: threatname
                      criteria: eq
                      value: Win32
                  page: 2
                  format: json
                  records_per_page: 100
                  sort: threatname desc
  /api/rha1/analytics/v1/query/{rha1_type}/{sha1}:
    get:
      summary: 'TCA-0321: RHA1 Analytics Single Query'
      tags:
        - Malware Hunting
      operationId: get-api-rha1-analytics-v1-query-rha1_type-sha1
      parameters:
        - name: rha1_type
          in: path
          required: true
          schema:
            type: string
            enum:
              - pe01
              - elf01
              - machO01
              - pe02
          description: Required parameter. A measure of RHA1 precision level; represents the degree to which a file is functionally similar to another file. The following precision levels are supported - 25% for PE, MachO and ELF files (expressed as pe01, elf01, machO01), and 50% for PE files (expressed as pe02).
        - name: sha1
          in: path
          required: true
          schema:
            type: string
          description: Must be a valid SHA1 hash.
        - name: extended
          in: query
          schema:
            type: boolean
            default: 'false'
          description: 'Optional parameter. Supported values are **true** (sends the extended data set in the response) and **false** (sends only the list of SHA1 hashes). The default is **false**. If the extended option is selected, each SHA1 hash in the list will be expanded with additional metadata: classification, threat level, trust factor, malware family name, threat name, malware type, targeted platform and subplatform; SHA1, MD5, and SHA256 hashes; sample size, sample type, download availability, first and last seen dates (UTC).'
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The RHA1 Analytics API provides real-time statistics (counters) for malicious, suspicious and known samples that are functionally similar to the requested SHA1 hash at the requested precision level. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      rha1_counters:
                        sha1: 9c489fcaee9abedd736b474d7f9076d23ea2bb9b
                        rha1_type: elf01
                        rha1_first_seen: '2017-09-30T10:32:52.736000'
                        rha1_last_seen: '2017-09-30T10:32:52'
                        sample_counters:
                          known: 1
                          malicious: 0
                          suspicious: 0
                          total: 1
                        sample_metadata:
                          md5: c6b0da0e905f73ff07a73a6a39c682a0
                          sha256: bc01d76ad41910b6b411cbaac6d128d9895b0d8c2b5ce492efb2a8a61987b4dc
                          classification: KNOWN
                          sample_type: ELF32 Little/SO
                          sample_size: 9568
                          sample_available: false
                          trust_factor: 2
                          threat_level: 0
                          first_seen: '2017-09-30T10:32:52.736000'
                          last_seen: '2021-06-24T07:49:39.714000'
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      unknown_hashes:
                        type: array
                        items:
                          type: string
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            sha1:
                              type: string
                            rha1_type:
                              type: string
                            rha1_first_seen:
                              type: integer
                            rha1_last_seen:
                              type: integer
                            sample_counters:
                              type: object
                              properties:
                                known:
                                  type: integer
                                malicious:
                                  type: integer
                                suspicious:
                                  type: integer
                                total:
                                  type: integer
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/rha1/analytics/v1/query/elf01/9c489fcaee9abedd736b474d7f9076d23ea2bb9b?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/rha1/analytics/v1/query/elf01/9c489fcaee9abedd736b474d7f9076d23ea2bb9b?format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/rha1/analytics/v1/query/{post_format}:
    post:
      summary: 'TCA-0321: RHA1 Analytics Bulk Query'
      tags:
        - Malware Hunting
      operationId: post-api-rha1-analytics-v1-query-post_format
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: 'The RHA1 Analytics API provides real-time statistics (counters) for malicious, suspicious and known samples that are functionally similar to the requested SHA1 hash at the requested precision level. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      unknown_hashes:
                        - 70d1d32e783dac03a7000616e63207f17b996807
                      entries:
                        - sha1: 70d1d32e783dac03a7000616e63207f17b996809
                          rha1_type: pe01
                          rha1_first_seen: 1302388871000
                          rha1_last_seen: 1736996147879
                          sample_counters:
                            known: 12160
                            malicious: 21168
                            suspicious: 2136
                            total: 35464
                        - sha1: 0dd1bc46e96d41591294e8c13c6eb7f6212be2ed
                          rha1_type: pe01
                          rha1_first_seen: 1306365720000
                          rha1_last_seen: 1736974860000
                          sample_counters:
                            known: 8
                            malicious: 27418117
                            suspicious: 11
                            total: 27418136
                        - sha1: 57dafb1b1f5c0e0217fc90e25355386cb087886f
                          rha1_type: pe01
                          rha1_first_seen: 1348848540000
                          rha1_last_seen: 1735344391997
                          sample_counters:
                            known: 207
                            malicious: 5
                            suspicious: 2
                            total: 214
                        - sha1: eb7f7f9b7744d0f28ab82f8272fbe643e56a070c
                          rha1_type: pe01
                          rha1_first_seen: 1300463554000
                          rha1_last_seen: 1737008856829
                          sample_counters:
                            known: 638907
                            malicious: 33935
                            suspicious: 802
                            total: 673644
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      unknown_hashes:
                        type: array
                        items:
                          required: []
                          properties: {}
                      entries:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - sha1
                            - rha1_type
                            - rha1_first_seen
                            - rha1_last_seen
                          properties:
                            sha1:
                              type: string
                            rha1_type:
                              type: string
                            rha1_first_seen:
                              type: number
                            rha1_last_seen:
                              type: number
                            sample_counters:
                              type: object
                              properties:
                                known:
                                  type: number
                                malicious:
                                  type: number
                                suspicious:
                                  type: number
                                total:
                                  type: number
                              required:
                                - known
                                - malicious
                                - suspicious
                                - total
                    required:
                      - unknown_hashes
                      - entries
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/rha1/analytics/v1/query/json' --header 'Content-Type: application/json' --data '{
              "rl": {
                "query": {
                  "rha1_type": "pe01",
                  "extended": false,
                  "response_format": "json",
                  "hashes": [
                    "70d1d32e783dac03a7000616e63207f17b996809",
                    "0dd1bc46e96d41591294e8c13c6eb7f6212be2ed",
                    "57dafb1b1f5c0e0217fc90e25355386cb087886f",
                    "eb7f7f9b7744d0f28ab82f8272fbe643e56a070c",
                    "70d1d32e783dac03a7000616e63207f17b996807"
                    ]
                  }
                }
              }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/rha1/analytics/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "rha1_type": "pe01",
                  "extended": False,
                  "response_format": "json",
                  "hashes": [
                    "70d1d32e783dac03a7000616e63207f17b996809",
                    "0dd1bc46e96d41591294e8c13c6eb7f6212be2ed",
                    "57dafb1b1f5c0e0217fc90e25355386cb087886f",
                    "eb7f7f9b7744d0f28ab82f8272fbe643e56a070c",
                    "70d1d32e783dac03a7000616e63207f17b996807"
                    ]
                  }
                }
              }

            response = requests.post(url, json=json, auth=('username', 'password'))
            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              description: ''
              type: object
              properties:
                rl:
                  type: object
                  required:
                    - query
                  properties:
                    query:
                      type: object
                      required:
                        - rha1_type
                        - extended
                        - response_format
                        - hashes
                      properties:
                        rha1_type:
                          type: string
                        extended:
                          type: boolean
                        response_format:
                          type: string
                          enum:
                            - json
                            - xml
                          example: json
                          minLength: 3
                        hashes:
                          type: array
                          items:
                            type: object
              required:
                - rl
        description: Up to 1000 hashes can be submitted in one request.
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/uri_index/v1/query/{hash}:
    get:
      summary: 'TCA-0401: URI to Hash Search'
      tags:
        - Network Threat Intelligence
      operationId: get-api-uri_index-v1-query
      parameters:
        - name: hash
          in: path
          required: true
          schema:
            type: string
          description: SHA1 hash value of the URI string for which the user is requesting data from the service. The user should generate a SHA1 hash of the URI string prior to submitting a request.
        - $ref: '#/components/parameters/Classification'
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The URI to Hash Search API provides a list of all available SHA1 hashes associated with the requested URI. The following URI types are supported: email, URL, IPv4 address, domain. Only one URI can be submitted in one request. Sending requests using the GET method requires the SHA1 value of the URI string, while the POST method accepts the URI string value in plain text. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      uri_index:
                        query_uri: google.com
                        next_page_sha1: 000105c9b3765fa90f1e9eae1fb8dc4cc0cac50c
                        sha1_list:
                          - 0000004de689bdf7ee43a91bbf377142f1abcf57
                          - 00000067a0a26a489e46560d64a67735a23fe697
                          - 0000007135278826e0f5ab9188e45b67f130f755
                          - 00000080f7036ed995f82e7ccc3e10c5bb32891e
                          - 000000c1eea316d98aec2fd42071292a2a3cd014
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      uri_index:
                        type: object
                        properties:
                          query_uri:
                            type: string
                          next_page_sha1:
                            type: string
                          sha1_list:
                            type: array
                            items:
                              type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/uri_index/v1/query/c2208abde9668e8e9815c3690855edd1e63abeac?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/uri_index/v1/query/c2208abde9668e8e9815c3690855edd1e63abeac?format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    post:
      summary: 'TCA-0401: URI to Hash Search (paginated)'
      tags:
        - Network Threat Intelligence
      operationId: post-api-uri_index-v1-query-hash
      parameters:
        - name: hash
          in: path
          required: true
          schema:
            type: string
          description: Next page hash value.
        - name: 'Content-Type:'
          in: header
          schema:
            type: string
            enum:
              - application/json
              - text/xml
          required: true
          description: Required parameter that defines the POST payload format.
        - $ref: '#/components/parameters/ResponseFormat'
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      uri_index:
                        query_uri: google.com
                        next_page_sha1: 000105c9b3765fa90f1e9eae1fb8dc4cc0cac50c
                        sha1_list:
                          - 0000004de689bdf7ee43a91bbf377142f1abcf57
                          - 00000067a0a26a489e46560d64a67735a23fe697
                          - 0000007135278826e0f5ab9188e45b67f130f755
                          - 00000080f7036ed995f82e7ccc3e10c5bb32891e
                          - 000000c1eea316d98aec2fd42071292a2a3cd014
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      uri_index:
                        type: object
                        properties:
                          query_uri:
                            type: string
                          next_page_sha1:
                            type: string
                          sha1_list:
                            type: array
                            items:
                              type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/uri_index/v1/query?format=json' --header 'Content-Type: application/json' --data '{
                "rl" : {
                 "query" : {
                   "uri" : "127.0.0.1"
                  }
                }
             }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/uri_index/v1/query?format=json"

            json = {
              "rl": {
                "query": {
                  "uri": "google.com",
                  "next_page_sha1": "000105c9b3765fa90f1e9eae1fb8dc4cc0cac50c"
                }
              }
            }

            headers = {
              'Content-Type': 'application/json',
              'Accept': 'application/json',
            }

            response = requests.post(url, headers=headers, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        uri:
                          type: string
                          description: |-
                            `uri` is a required parameter used to submit a plain text URI for which the user is requesting data from the service. Only one URI can be submitted in one request. Supported URI types are: email (e.g., `user@domain.com`), URL (e.g., `http://domain.com/download/picture.jpg`), IPv4 address (e.g., `127.0.0.1`), domain (e.g., `domain.com`).
                             
                        next_page_sha1:
                          type: string
                          description: '`next_page_sha1` is an optional parameter used for pagination. To get the next page of results from the API, use the `next_page_sha1` value from the response with this parameter in a new request. When the parameter is not included in the request, only the first page of results is returned.'
                      required:
                        - uri
            examples:
              JSON Request Example:
                summary: Example JSON request
                value:
                  rl:
                    query:
                      uri: google.com
                      next_page_sha1: 000105c9b3765fa90f1e9eae1fb8dc4cc0cac50c
      description: 'The URI to Hash Search API provides a list of all available SHA1 hashes associated with the requested URI. The following URI types are supported: email, URL, IPv4 address, domain. Only one URI can be submitted in one request. Sending requests using the GET method requires the SHA1 value of the URI string, while the POST method accepts the URI string value in plain text. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).'
  /api/uri_index/v1/query:
    post:
      summary: 'TCA-0401: URI to Hash Search'
      tags:
        - Network Threat Intelligence
      operationId: post-api-uri_index-v1-query
      parameters:
        - name: 'Content-Type:'
          in: header
          schema:
            type: string
            enum:
              - application/json
              - text/xml
          required: true
          description: Required parameter that defines the POST payload format.
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The URI to Hash Search service provides a list of all available SHA1 hashes associated with the requested URI. This service takes into account network IOCs extracted during file static analysis and uses that data to correlate URIs with samples. The following URI types are supported: email, URL, IPv4 address, and domain. Only one URI can be submitted in one request. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).'
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      uri_index:
                        query_uri: google.com
                        next_page_sha1: 000105c9b3765fa90f1e9eae1fb8dc4cc0cac50c
                        sha1_list:
                          - 0000004de689bdf7ee43a91bbf377142f1abcf57
                          - 00000067a0a26a489e46560d64a67735a23fe697
                          - 0000007135278826e0f5ab9188e45b67f130f755
                          - 00000080f7036ed995f82e7ccc3e10c5bb32891e
                          - 000000c1eea316d98aec2fd42071292a2a3cd014
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      uri_index:
                        type: object
                        properties:
                          query_uri:
                            type: string
                          next_page_sha1:
                            type: string
                          sha1_list:
                            type: array
                            items:
                              type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/uri_index/v1/query?format=json' --header 'Content-Type: application/json' --data '{
                "rl" : {
                 "query" : {
                   "uri" : "127.0.0.1"
                  }
                }
             }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/uri_index/v1/query?format=json"

            json = {
              "rl": {
                "query": {
                  "uri": "google.com"
                }
              }
            }

            headers = {
              'Content-Type': 'application/json',
              'Accept': 'application/json',
            }

            response = requests.post(url, headers=headers, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        uri:
                          type: string
                          description: '`uri` is a required parameter used to submit a plain text URI for which the user is requesting data from the service. Only one URI can be submitted in one request. Supported URI types are: email (e.g., `user@domain.com`), URL (e.g., `http://domain.com/download/picture.jpg`), IPv4 address (e.g., `127.0.0.1`), domain (e.g., `domain.com`).'
                      required:
                        - uri
            examples:
              JSON Request Example:
                summary: Example JSON request
                value:
                  rl:
                    query:
                      uri: google.com
        description: ''
  /api/uri_index/v1/query/{uri_sha1}/{next_page_sha1}:
    get:
      summary: 'TCA-0401: URI to Hash Search (paginated)'
      tags:
        - Network Threat Intelligence
      operationId: get-api-uri_index-v1-query-paginated-paginated
      parameters:
        - $ref: '#/components/parameters/Classification'
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The URI to Hash Search API provides a list of all available SHA1 hashes associated with the requested URI. The following URI types are supported: email, URL, IPv4 address, domain. Only one URI can be submitted in one request. Sending requests using the GET method requires the SHA1 value of the URI string, while the POST method accepts the URI string value in plain text. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      uri_index:
                        query_uri: google.com
                        next_page_sha1: 000105c9b3765fa90f1e9eae1fb8dc4cc0cac50c
                        sha1_list:
                          - 0000004de689bdf7ee43a91bbf377142f1abcf57
                          - 00000067a0a26a489e46560d64a67735a23fe697
                          - 0000007135278826e0f5ab9188e45b67f130f755
                          - 00000080f7036ed995f82e7ccc3e10c5bb32891e
                          - 000000c1eea316d98aec2fd42071292a2a3cd014
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      uri_index:
                        type: object
                        properties:
                          query_uri:
                            type: string
                          next_page_sha1:
                            type: string
                          sha1_list:
                            type: array
                            items:
                              type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/uri_index/v1/query/c2208abde9668e8e9815c3690855edd1e63abeac?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/uri_index/v1/query/c2208abde9668e8e9815c3690855edd1e63abeac?format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - schema:
          type: string
        name: uri_sha1
        in: path
        required: true
        description: The SHA1 hash value of the URI string
      - $ref: '#/components/parameters/NextPage'
  /api/uri/statistics/uri_state/sha1/{uri_sha1}:
    get:
      summary: 'TCA-0402: URI Statistics'
      tags:
        - Network Threat Intelligence
      operationId: get-api-uri-statistics-uri_state-sha1-uri_sha1
      parameters:
        - name: uri_sha1
          in: path
          required: true
          schema:
            type: string
          description: 'The SHA1 hash value of the URI string for which the user is requesting data from the service. The user should generate a SHA1 hash of the URI string prior to submitting a request. Supported URI types are: email (e.g., `user@domain.com`), URL (e.g., `http://domain.com/download/picture.jpg`), IPv4 address (e.g., `127.0.0.1`), domain (e.g., `domain.com`).'
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The URI Statistics API provides statistical information on how many known, malicious, and suspicious samples are associated with a particular URI. The following URI types are supported: email, URL, IPv4 address, domain. Only one URI can be submitted in one request. This service accepts only SHA1 values of URI strings. Requested URI strings cannot be in plain text. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).'
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      uri_state:
                        url: http://google.com
                        sha1: 234988566c9a0a9cf952cec82b143bf9c207ac16
                        uri_type: url
                        counters:
                          known: 526795
                          malicious: 295091
                          suspicious: 4514
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      uri_state:
                        type: object
                        properties:
                          url:
                            type: string
                          sha1:
                            type: string
                          uri_type:
                            type: string
                          counters:
                            type: object
                            properties:
                              known:
                                type: integer
                              malicious:
                                type: integer
                              suspicious:
                                type: integer
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/uri/statistics/uri_state/sha1/234988566c9a0a9cf952cec82b143bf9c207ac16?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/uri/statistics/uri_state/sha1/234988566c9a0a9cf952cec82b143bf9c207ac16?format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/networking/url/v1/report/query/{post_format}:
    post:
      summary: 'TCA-0403: URL Threat Intelligence (report)'
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-url-v1-report-query
      description: This service returns the report for the submitted URL. The report contains the ReversingLabs URL classification status, URL reputation from various reputation sources, metadata for performed URL analyses, statistics of files found on the submitted URL mapped to their classification, and an overview of the most common threats. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      sha1: 9c17e047f58f9220a7008d4f18152fee4d111d14
                      base64: aHR0cDovL2V4YW1wbGUuY29tLw
                      analysis:
                        first_analysis: '2024-12-17T12:36:06'
                        analysis_history:
                          - analysis_id: 17344388388189dc
                            analysis_time: '2024-12-17T12:36:06'
                            http_response_code: 200
                            availability_status: online
                            domain: example.com
                            serving_ip_address: 93.184.215.14
                          - analysis_id: 1734451388159c17
                            analysis_time: '2024-12-17T16:05:10'
                            http_response_code: 200
                            availability_status: online
                            domain: example.com
                            serving_ip_address: 93.184.215.14
                          - analysis_id: 1734462209028ece
                            analysis_time: '2024-12-17T19:05:35'
                            http_response_code: 200
                            availability_status: online
                            domain: example.com
                            serving_ip_address: 93.184.215.14
                          - analysis_id: 1734487456868ece
                            analysis_time: '2024-12-18T02:06:04'
                            http_response_code: 200
                            availability_status: online
                            domain: example.com
                            serving_ip_address: 93.184.215.14
                        last_analysis:
                          analysis_id: 1735108787428ece
                          analysis_time: '2024-12-25T06:42:19'
                          http_response_code: 200
                          availability_status: online
                          domain: example.com
                          serving_ip_address: 93.184.215.14
                        analysis_count: 478
                        statistics:
                          unknown: 0
                          known: 4
                          suspicious: 0
                          malicious: 0
                          total: 4
                      dynamic_analysis:
                        analysis_history:
                          - analysis_id: a67ee1e9-0391-4ea1-8f19-d669732ec93c
                            analysis_time: '2024-03-06T21:17:58'
                            platform: windows10
                            classification: SUSPICIOUS
                            risk_score: 6
                            threat_type:
                              - Phishing
                            browser: Google chrome 69
                          - analysis_id: b2ba7554-1254-430c-a2e7-d8e73217e203
                            analysis_time: '2024-05-17T10:20:15'
                            platform: windows10
                            classification: CLEAN
                            risk_score: 0
                            browser: Google chrome 69
                        last_analysis:
                          analysis_id: b2ba7554-1254-430c-a2e7-d8e73217e203
                          analysis_time: '2024-05-17T10:20:15'
                          platform: windows10
                          classification: CLEAN
                          risk_score: 0
                          browser: Google chrome 69
                      third_party_reputations:
                        sources:
                          - source: 0xSI_f33d
                            update_time: '2025-01-15T06:21:21'
                            detection: undetected
                          - source: adminus_labs
                            update_time: '2025-01-15T09:34:54'
                            detection: undetected
                          - source: apwg
                            update_time: '2025-01-15T02:19:23'
                            detection: undetected
                          - source: crdf
                            update_time: '2025-01-15T09:29:22'
                            detection: undetected
                          - source: cyradar
                            update_time: '2025-01-15T01:29:02'
                            detection: malicious
                            detect_time: '2022-06-08T12:55:18'
                          - source: cyren
                            update_time: '2025-01-15T06:13:42'
                            detection: undetected
                          - source: mrg
                            update_time: '2025-01-15T08:45:56'
                            detection: undetected
                          - source: mute
                            update_time: '2025-01-15T05:08:13'
                            detection: undetected
                          - source: netstar
                            update_time: '2025-01-15T09:12:05'
                            detection: undetected
                          - source: openphish
                            update_time: '2025-01-14T17:55:45'
                            detection: undetected
                          - source: osint
                            update_time: '2025-01-15T01:31:01'
                            detection: undetected
                          - source: phishing_database
                            update_time: '2024-12-17T10:46:51'
                            detection: undetected
                          - source: phishstats
                            update_time: '2025-01-14T23:46:59'
                            detection: undetected
                          - source: phishtank
                            update_time: '2025-01-15T03:22:16'
                            detection: undetected
                          - source: threatfox_abuse_ch
                            update_time: '2025-01-15T08:19:51'
                            detection: undetected
                          - source: urlhaus
                            update_time: '2025-01-14T22:57:06'
                            detection: undetected
                          - source: mnemonic
                            update_time: '2025-01-14T22:51:44'
                            detection: undetected
                          - source: alphamountain
                            update_time: '2024-12-18T09:37:52'
                            detection: clean
                            categories:
                              - parked_domain
                              - information_technology
                            detect_time: '2024-12-18T09:37:52'
                          - source: forcepoint
                            update_time: '2024-12-18T09:37:51'
                            detection: undetected
                            categories:
                              - information_technology
                            detect_time: '2024-12-18T09:37:51'
                          - source: botvrij
                            update_time: '2025-01-15T02:25:17'
                            detection: undetected
                        statistics:
                          total: 20
                          malicious: 1
                          clean: 1
                          suspicious: 0
                          undetected: 18
                      last_seen: '2024-12-25T06:42:19'
                      classification: malicious
                      reason: user_override
                      threat_level: 5
                      categories:
                        - phishing
                      requested_url: http://example.com
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - requested_url
                      - classification
                      - reason
                      - sha1
                      - base64
                      - analysis
                      - third_party_reputations
                    properties:
                      requested_url:
                        type: string
                      classification:
                        type: string
                        enum:
                          - malicious
                          - suspicious
                          - known
                          - unknown
                      last_seen:
                        type: string
                        description: Time when the URL was last seen in the ReversingLabs system (UTC).
                      reason:
                        type: string
                        description: The reason why the URL was given a classification. This parameter is only shown if the classification is not unknown. If the classification reason was propagated from a URL redirection, it will be prefixed with redirect_ (e.g redirect_file_reputation).
                      threat_name:
                        type: string
                        description: Standardized malware name indicating the type, platform, and family of the threat associated with the URL. Conforms to the ReversingLabs malware naming standard. Applies to malicious and suspicious URIs only
                      sha1:
                        type: string
                        description: The SHA1 hash of the normalized submitted URL.
                      base64:
                        type: string
                      analysis:
                        type: object
                        description: Information on performed static analyses.
                        required:
                          - first_analysis
                          - analysis_count
                          - last_analysis
                          - statistics
                          - analysis_history
                          - dynamic_analyses
                        properties:
                          first_analysis:
                            type: string
                            description: Time when the URL was analyzed for the first time (UTC).
                          analysis_count:
                            type: number
                            description: The total number of analyses performed on the submitted URL.
                          last_analysis:
                            type: object
                            description: Metadata about the last analysis.
                            required:
                              - analysis_id
                              - analysis_time
                              - final_url
                              - http_response_code
                              - availability_status
                              - domain
                              - serving_ip_address
                            properties:
                              analysis_id:
                                type: string
                                description: The unique identifier of the analysis.
                              analysis_time:
                                type: string
                                description: Time when the URL was analyzed (UTC).
                              final_url:
                                type: string
                                description: The URL that was analyzed after redirecting from the submitted URL.
                              http_response_code:
                                type: number
                                description: The HTTP status code returned by the analyzed site.
                              availability_status:
                                type: string
                                description: Indicates whether the analyzed URL was available or not (at the time of the analysis).
                              domain:
                                type: string
                                description: The domain that hosts the URL.
                              serving_ip_address:
                                type: string
                              screenshot_url:
                                type: string
                                description: The URL of the screenshot taken during the analysis. The URL is publicly accessible for a duration of 1 hour.
                              dom_url:
                                type: string
                                description: The URL of the DOM object that was analyzed. The URL is publicly accessible for a duration of 1 hour.
                          statistics:
                            type: object
                            required:
                              - suspicious
                              - unknown
                              - malicious
                              - known
                              - total
                            properties:
                              suspicious:
                                type: number
                              unknown:
                                type: number
                              malicious:
                                type: number
                              known:
                                type: number
                              total:
                                type: number
                          analysis_history:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              properties:
                                analysis_id:
                                  type: string
                                  description: The unique identifier of the analysis.
                                analysis_time:
                                  type: string
                                  description: Time when the report was generated.
                                final_url:
                                  type: string
                                  description: The URL that was analyzed after redirecting from the submitted URL
                                http_response_code:
                                  type: number
                                  description: The HTTP status code returned by the analyzed site.
                                availability_status:
                                  type: string
                                  description: Indicates whether the analyzed URL was available or not (at the time of the analysis).
                                domain:
                                  type: string
                                  description: The domain that hosts the URL.
                                serving_ip_address:
                                  type: string
                                screenshot_url:
                                  type: string
                                  description: The URL of the screenshot taken during the analysis. The URL is publicly accessible for a duration of 1 hour.
                                dom_url:
                                  type: string
                                  description: The URL of the DOM object that was analyzed. The URL is publicly accessible for a duration of 1 hour.
                              required:
                                - analysis_id
                                - analysis_time
                                - final_url
                                - http_response_code
                                - availability_status
                                - domain
                                - serving_ip_address
                          dynamic_analyses:
                            type: object
                            required:
                              - analysis_id
                              - analysis_time
                              - classification
                              - threat_type
                              - risk_score
                              - browser
                            properties:
                              analysis_id:
                                type: string
                                description: The unique identifier of the analysis.
                              analysis_time:
                                type: string
                                description: Time when the report was generated.
                              classification:
                                type: object
                                required:
                                  - malicious
                                  - suspicious
                                  - clean
                                properties:
                                  malicious:
                                    type: string
                                  suspicious:
                                    type: string
                                  clean:
                                    type: string
                              threat_type:
                                type: string
                                description: Defines the type of a threat. This field is not shown if the classification is UNKNOWN.
                              risk_score:
                                type: number
                                description: Value representing the trustworthiness or malicious severity of a sample. Risk score is expressed as a number from 0 to 10, with 0 indicating whitelisted samples from a reputable origin, and 10 indicating the most dangerous threats.
                              browser:
                                type: string
                                description: Browser-specific dynamic analysis detonation. The browser used for URL detonation is chrome.
                      third_party_reputations:
                        type: object
                        description: Information from third parties on this URL.
                        required:
                          - statistics
                          - sources
                        properties:
                          statistics:
                            type: object
                            required:
                              - total
                              - malicious
                              - clean
                              - undetected
                            properties:
                              total:
                                type: number
                              malicious:
                                type: number
                              suspicious:
                                type: number
                              clean:
                                type: number
                              undetected:
                                type: number
                          sources:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              properties:
                                source:
                                  type: string
                                  description: Name of the third party source.
                                update_time:
                                  type: string
                                  description: Time when the information from the source was last updated.
                                detection:
                                  type: string
                                  description: Detection for the submitted URL. The possible values are malicious/clean/undetected. If the URL is on a blacklist, it will be labeled as malicious. Whitelisted URLs will be considered clean, and if the source does not have any information about the URL, the value will be undetected.
                                detect_time:
                                  type: string
                                  description: Time when the URL was last detected or given a category by the source.
                                categories:
                                  type: array
                              required:
                                - source
                                - update_time
                                - detection
                                - detect_time
                                - categories
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/url/v1/report/query/json' --header 'Content-Type: application/json' --user <username>:<password> --data '{
            "rl": {
              "query": {
                "url": "http://example.com",
                "response_format": "json"
                }
              }
            }'
        - lang: Python
          source: |
            import requests
            import json
            url = "https://data.reversinglabs.com/api/networking/url/v1/report/query/json"
            json = {
              "rl": {
                "query": {
                  "url": "reversinglabs.com",
                  "response_format": "json"
                }
              }
            }
            response = requests.post(url, json=json, auth=('username', 'password'))
            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        url:
                          type: string
                          description: The URL for which to retrieve the report. Provide the full URL of a website including the protocol (https://www.example.org). Only http and https protocols are supported. If the protocol is missing from the submitted URL, http will be automatically prepended to the URL. Note that URL normalization is performed during request submission, so duplicate and empty elements in the URL may be automatically removed or converted.
                          format: uri
                        response_format:
                          type: string
                          description: Defines the response format.
                          enum:
                            - json
                            - xml
                          default: xml
                      required:
                        - url
    parameters:
      - $ref: '#/components/parameters/RequestFormat'
  /api/networking/url/v1/report/bulk_query/{post_format}:
    post:
      summary: 'TCA-0403: URL Threat Intelligence (report) (bulk)'
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-url-v1-report-bulk-query
      description: This service returns the report for the submitted URLs. The report for each contains the ReversingLabs URL classification status, URL reputation from various reputation sources, metadata for performed URL analyses, statistics of files found on the submitted URL mapped to their classification, and an overview of the most common threats. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      entries:
                        - requested_url: http://microtechnology.hk/fidex/
                          classification: malicious
                          last_seen: '2020-07-18T18:02:34'
                          analysis:
                            first_analysis: '2020-06-18T17:45:26'
                            analysis_count: 6
                            last_analysis:
                              analysis_id: 159509535435924b
                              analysis_time: '2020-07-18T18:02:34'
                              availability_status: offline
                              domain: microtechnology.hk
                            statistics:
                              known: 0
                              unknown: 0
                              suspicious: 0
                              malicious: 10
                              total: 10
                            analysis_history:
                              - analysis_id: 159509535435924b
                                analysis_time: '2020-07-18T18:02:34'
                                availability_status: offline
                                domain: microtechnology.hk
                              - analysis_id: 159310706659924b
                                analysis_time: '2020-06-25T17:44:26'
                                availability_status: offline
                                domain: microtechnology.hk
                              - analysis_id: 159258872979924b
                                analysis_time: '2020-06-19T17:45:29'
                                final_url: http://microtechnology.hk/fidex/
                                http_response_code: 200
                                availability_status: online
                                domain: microtechnology.hk
                                serving_ip_address: 84.17.55.85
                              - analysis_id: 159254551008924b
                                analysis_time: '2020-06-19T05:45:10'
                                final_url: http://microtechnology.hk/fidex/
                                http_response_code: 200
                                availability_status: online
                                domain: microtechnology.hk
                                serving_ip_address: 84.17.55.85
                              - analysis_id: 159251669624924b
                                analysis_time: '2020-06-18T21:44:56'
                                final_url: http://microtechnology.hk/fidex/
                                http_response_code: 200
                                availability_status: online
                                domain: microtechnology.hk
                                serving_ip_address: 84.17.55.85
                              - analysis_id: 159250213511924b
                                analysis_time: '2020-06-18T17:45:26'
                                final_url: http://microtechnology.hk/fidex/
                                http_response_code: 200
                                availability_status: online
                                domain: microtechnology.hk
                                serving_ip_address: 84.17.55.85
                            top_threats:
                              - threat_name: ByteCode-MSIL.Trojan.Kryptik
                                threat_level: 5
                                files_count: 9
                              - threat_name: ByteCode-MSIL.Trojan.AgentTesla
                                threat_level: 5
                                files_count: 1
                          third_party_reputations:
                            statistics:
                              total: 11
                              malicious: 0
                              clean: 0
                              undetected: 11
                            sources:
                              - source: ''
                                update_time: '2020-08-12T10:39:19'
                                detection: undetected
                              - source: ''
                                update_time: '2020-08-12T02:27:20'
                                detection: undetected
                              - source: ''
                                update_time: '2020-08-07T05:16:27'
                                detection: undetected
                              - source: ''
                                update_time: '2020-08-12T01:09:34'
                                detection: undetected
                              - source: ''
                                update_time: '2020-08-12T08:09:54'
                                detection: undetected
                              - source: ''
                                update_time: '2020-08-12T11:45:15'
                                detection: undetected
                        - sha1: b0de6c887db20340e8d682958f599489a0cf0c37
                          base64: aHR0cDovL2V4YW1wbGUyLmNvbS8
                          analysis:
                            first_analysis: '2022-07-27T15:50:28'
                            analysis_history:
                              - analysis_id: 165893704662b0de
                                analysis_time: '2022-07-27T15:50:28'
                                http_response_code: 200
                                availability_status: online
                                domain: example2.com
                                serving_ip_address: 147.182.251.31
                            last_analysis:
                              analysis_id: 165893704662b0de
                              analysis_time: '2022-07-27T15:50:28'
                              http_response_code: 200
                              availability_status: online
                              domain: example2.com
                              serving_ip_address: 147.182.251.31
                            analysis_count: 2
                            statistics:
                              unknown: 0
                              known: 1
                              suspicious: 0
                              malicious: 0
                              total: 1
                          third_party_reputations:
                            sources:
                              - source: ''
                                update_time: '2025-06-17T05:21:05'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T09:44:43'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T01:19:45'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T09:34:23'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T00:28:40'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T05:09:24'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-16T22:29:29'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T09:45:40'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T04:06:58'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T09:18:58'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-16T16:56:53'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T00:30:29'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T09:06:29'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-16T22:51:10'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T02:21:00'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T07:20:26'
                                detection: undetected
                              - source: urlhaus
                                update_time: '2025-06-17T09:32:23'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-17T09:52:30'
                                detection: undetected
                              - source: ''
                                update_time: '2025-06-08T02:46:31'
                                detection: undetected
                                detect_time: '2025-06-08T02:46:31'
                              - source: ''
                                update_time: '2025-06-17T01:25:40'
                                detection: undetected
                            statistics:
                              total: 20
                              malicious: 0
                              clean: 0
                              suspicious: 0
                              undetected: 20
                          last_seen: '2025-06-08T02:46:31'
                          first_seen: '2022-07-27T15:50:28'
                          classification: known
                          reason: file_reputation
                          threat_level: 0
                          requested_url: http://example2.com
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            requested_url:
                              type: string
                              description: The submitted URL.
                            classification:
                              type: string
                              description: URL classification based on the proprietary ReversingLabs algorithm that takes into account the 3rd party URL reputation and the latest file reputation of all files downloaded across all performed URL analyses. This means that a URL will be classified as malicious for as long as the sample that originally caused this classification is classified as malicious, regardless of whether the sample is present during a new scan.
                              enum:
                                - malicious
                                - suspicious
                                - known
                                - unknown
                            last_seen:
                              type: string
                              description: Time when the URL was last seen in the ReversingLabs system (UTC).
                            reason:
                              type: string
                              description: The reason why the URL was given a classification. This parameter is only shown if the classification is not unknown. If the classification reason was propagated from a URL redirection, it will be prefixed with redirect_ (e.g redirect_file_reputation).
                            threat_name:
                              type: string
                              description: Standardized malware name indicating the type, platform, and family of the threat associated with the URL. Conforms to the ReversingLabs malware naming standard. Applies to malicious and suspicious URIs only
                            sha1:
                              type: string
                              description: The SHA1 hash of the normalized submitted URL.
                            base64:
                              type: string
                              description: The Base64 encoding of the normalized submitted URL.
                            analysis:
                              type: object
                              description: Information on performed static analyses.
                              required:
                                - first_analysis
                                - analysis_count
                                - last_analysis
                                - statistics
                                - analysis_history
                                - dynamic_analyses
                              properties:
                                first_analysis:
                                  type: string
                                  description: Time when the URL was analyzed for the first time (UTC).
                                analysis_count:
                                  type: number
                                  description: The total number of analyses performed on the submitted URL.
                                last_analysis:
                                  type: object
                                  required:
                                    - analysis_id
                                    - analysis_time
                                    - final_url
                                    - http_response_code
                                    - availability_status
                                    - domain
                                    - serving_ip_address
                                  properties:
                                    analysis_id:
                                      type: string
                                      description: The unique identifier of the analysis.
                                    analysis_time:
                                      type: string
                                      description: Time when the URL was analyzed (UTC).
                                    final_url:
                                      type: string
                                      description: The URL that was analyzed after redirecting from the submitted URL.
                                    http_response_code:
                                      type: number
                                      description: The HTTP status code returned by the analyzed site.
                                    availability_status:
                                      type: string
                                      description: Indicates whether the analyzed URL was available or not (at the time of the analysis).
                                      enum:
                                        - online
                                        - offline
                                    domain:
                                      type: string
                                      description: The domain that hosts the URL.
                                    serving_ip_address:
                                      type: string
                                      description: The resolved IP address of the analyzed URL.
                                    screenshot_url:
                                      type: string
                                      description: The URL of the screenshot taken during the analysis. The URL is publicly accessible for a duration of 1 hour.
                                    dom_url:
                                      type: string
                                      description: The URL of the DOM object that was analyzed. The URL is publicly accessible for a duration of 1 hour.
                                statistics:
                                  type: object
                                  description: File counters mapped to classification. They include files downloaded across all performed analyses.
                                  required:
                                    - suspicious
                                    - unknown
                                    - malicious
                                    - known
                                    - total
                                  properties:
                                    suspicious:
                                      type: number
                                      description: The number of files classified as SUSPICIOUS.
                                    unknown:
                                      type: number
                                      description: The number of files classified as UNKNOWN.
                                    malicious:
                                      type: number
                                      description: The number of files classified as MALICIOUS.
                                    known:
                                      type: number
                                      description: The number of files classified as KNOWN.
                                    total:
                                      type: number
                                analysis_history:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    type: object
                                    properties:
                                      analysis_id:
                                        type: string
                                        description: The unique identifier of the analysis.
                                      analysis_time:
                                        type: string
                                        description: Time when the report was generated.
                                      final_url:
                                        type: string
                                        description: The URL that was analyzed after redirecting from the submitted URL
                                      http_response_code:
                                        type: number
                                        description: The HTTP status code returned by the analyzed site.
                                      availability_status:
                                        type: string
                                        description: Indicates whether the analyzed URL was available or not (at the time of the analysis).
                                      domain:
                                        type: string
                                        description: The domain that hosts the URL.
                                      serving_ip_address:
                                        type: string
                                      screenshot_url:
                                        type: string
                                        description: The URL of the screenshot taken during the analysis. The URL is publicly accessible for a duration of 1 hour.
                                      dom_url:
                                        type: string
                                        description: The URL of the DOM object that was analyzed. The URL is publicly accessible for a duration of 1 hour.
                                    required:
                                      - analysis_id
                                      - analysis_time
                                      - final_url
                                      - http_response_code
                                      - availability_status
                                      - domain
                                      - serving_ip_address
                                dynamic_analyses:
                                  type: object
                                  required:
                                    - analysis_id
                                    - analysis_time
                                    - classification
                                    - threat_type
                                    - risk_score
                                    - browser
                                  properties:
                                    analysis_id:
                                      type: string
                                      description: The unique identifier of the analysis.
                                    analysis_time:
                                      type: string
                                      description: Time when the report was generated.
                                    classification:
                                      type: object
                                      required:
                                        - malicious
                                        - suspicious
                                        - clean
                                      properties:
                                        malicious:
                                          type: string
                                        suspicious:
                                          type: string
                                        clean:
                                          type: string
                                    threat_type:
                                      type: string
                                      description: Defines the type of a threat. This field is not shown if the classification is UNKNOWN.
                                    risk_score:
                                      type: number
                                    browser:
                                      type: string
                                      description: Browser-specific dynamic analysis detonation. The browser used for URL detonation is chrome.
                                    optional_parameters:
                                      type: string
                                      description: An object containing a list of optional parameters used during analysis.
                            third_party_reputations:
                              type: object
                              description: Information from third parties on this URL.
                              required:
                                - statistics
                                - sources
                              properties:
                                statistics:
                                  type: object
                                  description: File counters mapped to classification. They include files downloaded across all performed analyses.
                                  required:
                                    - total
                                    - malicious
                                    - clean
                                    - undetected
                                  properties:
                                    total:
                                      type: number
                                    malicious:
                                      type: number
                                    suspicious:
                                      type: number
                                    clean:
                                      type: number
                                    undetected:
                                      type: number
                                sources:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    type: object
                                    properties:
                                      source:
                                        type: string
                                        description: Name of the third party source.
                                      update_time:
                                        type: string
                                        description: Time when the information from the source was last updated.
                                      detection:
                                        type: string
                                        description: Detection for the submitted URL. The possible values are malicious/clean/undetected. If the URL is on a blacklist, it will be labeled as malicious. Whitelisted URLs will be considered clean, and if the source does not have any information about the URL, the value will be undetected.
                                        enum:
                                          - malicious
                                          - clean
                                          - undetected
                                      detect_time:
                                        type: string
                                        description: Time when the URL was last detected or given a category by the source.
                                      categories:
                                        type: array
                                        description: URL categorization according to the source, e.g. phishing. Not all sources provide categorization information.
                                    required:
                                      - source
                                      - update_time
                                      - detection
                                      - detect_time
                                      - categories
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/url/v1/report/bulk_query/json' --header 'Content-Type: application/json' --user <username>:<password> --data '{
            "rl": {
              "query": {
                "urls": [
                    "http://example.com",
                    "https://example2.com"
                ],
                "response_format": "json"
                }
              }
            }'
        - lang: Python
          source: |
            import requests
            import json
            url = "https://data.reversinglabs.com/api/networking/url/v1/report/bulk_query/json"
            json = {
              "rl": {
                "query": {
                  "urls": [
                    "reversinglabs.com",
                    "example.com"
                  ],
                  "response_format": "json"
                }
              }
            }
            response = requests.post(url, json=json, auth=('username', 'password'))
            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        urls:
                          type: array
                          description: |-
                            The URLs for which to retrieve the report. Provide the full URL of a website including the protocol (`https://www.example.org`). Only `http` and `https` protocols are supported.

                            If the protocol is missing from the submitted URL, `http` will be automatically prepended to the URL. Note that URL normalization is performed during request submission, so duplicate and empty elements in the URL may be automatically removed or converted. 

                            The limit is 100 URLs per request.
                          items:
                            type: string
                            format: uri
                        response_format:
                          type: string
                          description: 'Defines the response format. Supported values: `xml` or `json`.'
                          enum:
                            - json
                            - xml
                          default: xml
                      required:
                        - url
    parameters:
      - $ref: '#/components/parameters/RequestFormat'
  /api/networking/url/v1/downloaded_files/query/{post_format}:
    post:
      summary: 'TCA-0403: URL Threat Intelligence (downloaded files)'
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-url-v1-downloaded_files-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service provides a list of hashes for files downloaded from the submitted URL, across all analyses, during the last analysis, or those downloaded during a specific analysis. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      requested_url:
                        type: string
                        description: The submitted URL.
                      first_analysis:
                        type: string
                        description: Time when the URL was analyzed for the first time (UTC).
                      last_analysis:
                        type: string
                        description: Metadata about the last analysis.
                      analysis_count:
                        type: number
                        description: The total number of analyses performed on the submitted URL.
                      total_files_count:
                        type: number
                        description: The total number of files downloaded from the submitted URL (all crawls).
                      files:
                        type: array
                        description: A list of files and their metadata.
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - sha1
                            - first_download
                            - last_download
                            - classification
                            - md5
                            - sha256
                            - sample_available
                            - first_seen
                            - last_seen
                            - sample_type
                            - sample_size
                          properties:
                            sha1:
                              type: string
                              description: The SHA1 hash of the normalized submitted URL.
                            first_download:
                              type: string
                              description: Time when the file was first downloaded (UTC).
                            last_download:
                              type: string
                              description: Time when the file was last downloaded (UTC).
                            classification:
                              type: string
                              description: URL classification based on the proprietary ReversingLabs algorithm that takes into account the 3rd party URL reputation and the latest file reputation of all files downloaded across all performed URL analyses. This means that a URL will be classified as malicious for as long as the sample that originally caused this classification is classified as malicious, regardless of whether the sample is present during a new scan.
                            md5:
                              type: string
                              description: MD5 of the file.
                            sha256:
                              type: string
                              description: SHA256 of the file.
                            sample_available:
                              type: boolean
                              description: Indicates whether the sample is present in the ReversingLabs storage and available for download (true) or if it's not available (false).
                            first_seen:
                              type: string
                              description: Time when the sample was first seen in the ReversingLabs system (UTC).
                            last_seen:
                              type: string
                              description: The last time when the file received impactful changes that updated its threat intelligence report. (UTC)
                            sample_type:
                              type: string
                              description: File type, as detected by Spectra Core.
                            sample_size:
                              type: number
                              description: File size (in bytes).
                    required:
                      - requested_url
                      - first_analysis
                      - last_analysis
                      - analysis_count
                      - total_files_count
                      - files
                required:
                  - rl
              example:
                rl:
                  requested_url: http://example.com/
                  first_analysis: '1970-01-19T16:07:25'
                  last_analysis: '2024-12-25T06:42:19'
                  analysis_count: 478
                  total_files_count: 4
                  files:
                    - sha1: 0e973b59f476007fd10f87f347c3956065516fc0
                      classification: KNOWN
                      first_download: '2018-12-11T01:17:43'
                      last_download: '2022-05-19T14:18:20'
                    - sha1: 4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047
                      classification: KNOWN
                      first_download: '2022-02-08T11:34:14'
                      last_download: '2024-12-25T06:42:19'
                    - sha1: 9a1fbf3b052e9be0651cd65a52c9b22076e3c155
                      classification: KNOWN
                      first_download: '2024-03-11T15:03:35'
                      last_download: '2024-12-25T06:42:19'
                    - sha1: b6c7bddcb854735e92177f00e76730737faecebe
                      classification: KNOWN
                      first_download: '2023-07-12T08:23:39'
                      last_download: '2024-02-21T08:54:09'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/url/v1/downloaded_files/query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
                "rl": {
                  "query": {
                    "url": "reversinglabs.com",
                    "response_format": "json",
                    "classification": "KNOWN",
                    "limit": 1000,
                    "extended": true
                  }
                }
              }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/url/v1/downloaded_files/query/json"

            json = {
              "rl": {
                "query": {
                  "url": "reversinglabs.com",
                  "response_format": "json",
                  "classification": "KNOWN",
                  "limit": 1000,
                  "extended": True
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      description: Query parameters. Use either `url` or `analysis_id`, but not both.
                      properties:
                        url:
                          type: string
                          format: uri
                          description: The submitted URL. Cannot be used in combination with `analysis_id`.
                        analysis_id:
                          type: string
                          description: The unique identifier of the analysis. Cannot be used in combination with `url`.
                        last_analysis:
                          type: boolean
                          default: false
                          description: If set to true, the listed files will be exclusively the ones that were downloaded during the most recent analysis.
                        response_format:
                          type: string
                          description: Defines the response format.
                          enum:
                            - json
                            - xml
                          default: xml
                        limit:
                          type: integer
                          default: 1000
                          description: The number of files to return in the response.
                        classification:
                          type: string
                          enum:
                            - KNOWN
                            - SUSPICIOUS
                            - MALICIOUS
                            - UNKNOWN
                          description: If this parameter is provided in the request, the response will contain only samples that match the requested classification.
                        extended:
                          type: boolean
                          default: false
                          description: Allows choosing between true - extended, and false - non-extended data set (default).
  /api/networking/url/v1/notifications/query/from/{time_format}/{time_value}:
    get:
      summary: 'TCA-0403: URL Threat Intelligence (notifications) (time range)'
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-url-v1-notifications-query
      parameters:
        - $ref: '#/components/parameters/TimeFormat'
        - name: time_value
          in: path
          required: true
          schema:
            type: string
            format: Unix timestamp OR date-time
          description: Accepts values formatted according to the format set in the time_format parameter.
        - $ref: '#/components/parameters/ResponseFormat'
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
            default: 1000
            example: 50
          description: Specifies the maximum number of reports to return in the response.
      description: This service provides a continuous list of completed analyses. The records enter the feed once the submitted URL is analyzed to completion and the report is ready. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      urls:
                        - url: http://ww12.fwiwk.biz/qce?usid=16&utid=36280477566
                          analysis_id: 1736934010697fcd
                          analysis_time: '2025-01-15T09:40:12'
                          availability_status: online
                          final_url: http://ww12.fwiwk.biz/qce?usid=16&utid=36280477566
                      next_page: 17369340129ac2fbb4e05bfab575c2b47bb05530ecc97615d9
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      urls:
                        type: array
                        items:
                          type: object
                          properties:
                            url:
                              type: string
                            final_url:
                              type: string
                              description: The URL that was analyzed after redirecting from the submitted URL.
                            availability_status:
                              type: string
                              description: Indicates whether the analyzed URL was available or not (at the time of the analysis).
                              enum:
                                - online
                                - offline
                            analysis_time:
                              type: string
                              description: Time when the report was generated.
                            analysis_id:
                              type: string
                              description: The unique identifier of the analysis.
                      next_page:
                        type: string
                        description: The pagination value for the next page is provided in the previous request response.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/networking/url/v1/notifications/query/latest?limit=1' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/networking/url/v1/notifications/query/latest?limit=1"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - schema:
          type: string
        name: time_format
        in: path
        required: true
      - schema:
          type: string
        name: time_value
        in: path
        required: true
  /api/networking/url/v1/notifications/query/from/{time_format}/{time_value}/page/{page}:
    get:
      summary: 'TCA-0403: URL Threat Intelligence (notifications) (time range) (paginated)'
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-url-v1-notifications-query-paginated
      description: This service provides a continuous list of completed analyses. The records enter the feed once the submitted URL is analyzed to completion and the report is ready. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      urls:
                        - url: http://ftp.br.debian.org/debian/dists/experimental/contrib/binary-s390x/Packages.diff/T-2025-01-14-0815.35-F-2024-03-01-0812.44.gz
                          analysis_id: 17369340884301ca
                          analysis_time: '2025-01-15T09:41:31'
                          availability_status: online
                          final_url: http://ftp.br.debian.org/debian/dists/experimental/contrib/binary-s390x/Packages.diff/T-2025-01-14-0815.35-F-2024-03-01-0812.44.gz
                        - url: http://d.winwin7xz.com/pc/rufus-4.6p.exe?rkzkjm=xqysk1
                          analysis_id: '1736934089930221'
                          analysis_time: '2025-01-15T09:41:31'
                          availability_status: online
                          final_url: http://d.winwin7xz.com/pc/rufus-4.6p.exe?rkzkjm=xqysk1
                        - url: http://ftp.br.debian.org/debian/dists/experimental/contrib/binary-armhf/Packages.diff/T-2025-01-14-0815.35-F-2025-01-08-1412.07.gz
                          analysis_id: 17369340897702d5
                          analysis_time: '2025-01-15T09:41:31'
                          availability_status: online
                          final_url: http://ftp.br.debian.org/debian/dists/experimental/contrib/binary-armhf/Packages.diff/T-2025-01-14-0815.35-F-2025-01-08-1412.07.gz
                        - url: http://ftp.br.debian.org/debian/dists/experimental/contrib/Contents-all.diff/T-2025-01-07-2013.59-F-2023-06-29-0205.47.gz
                          analysis_id: 17369340899103d2
                          analysis_time: '2025-01-15T09:41:31'
                          availability_status: online
                          final_url: http://ftp.br.debian.org/debian/dists/experimental/contrib/Contents-all.diff/T-2025-01-07-2013.59-F-2023-06-29-0205.47.gz
                        - url: https://persolsrbija.com/index.html?action=buy_now&products_id=651
                          analysis_id: 173693409004e26c
                          analysis_time: '2025-01-15T09:41:31'
                          availability_status: online
                          final_url: https://persolsrbija.com/index.html?action=buy_now&products_id=651
                      next_page: 17369341201014bfca229a2c6f307495d4bc6fedae92d1be57
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      urls:
                        type: array
                        items:
                          type: object
                          properties:
                            url:
                              type: string
                              description: The submitted URL.
                            final_url:
                              type: string
                              description: The URL that was analyzed after redirecting from the submitted URL.
                            availability_status:
                              type: string
                              description: Indicates whether the submitted URL was available or not (at the time of the analysis).
                              enum:
                                - online
                                - offline
                            analysis_time:
                              type: string
                              description: Time when the report was generated.
                            analysis_id:
                              type: string
                              description: The unique identifier of the analysis.
                      next_page:
                        type: string
                        description: The pagination value for the next page is provided in the previous request response.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/networking/url/v1/notifications/query/from/utc/2025-01-15T09:41:31/page/1748009847e2f4308951d568bd8e72e38bedaf95fa0e26de8d?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/networking/url/v1/notifications/query/from/utc/2025-01-15T09:41:31/page/1748009847e2f4308951d568bd8e72e38bedaf95fa0e26de8d?format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - name: time_value
        schema:
          type: string
        in: path
        required: true
        description: Accepts values formatted according to the format set in the time_format parameter.
      - name: page
        schema:
          type: string
        in: path
        required: true
        description: The pagination value for the next page is provided in the previous request response
      - $ref: '#/components/parameters/ResponseFormat'
      - name: limit
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 1000
          default: 1000
          example: 50
        description: Specifies the maximum number of reports to return in the response.
  /api/networking/url/v1/notifications/query/latest:
    get:
      summary: 'TCA-0403: URL Threat Intelligence (notifications) (latest)'
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-url-v1-notifications-query-latest
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
            default: 1000
            example: 50
          description: Specifies the maximum number of reports to return in the response.
      description: This service provides a continuous list of completed analyses. The records enter the feed once the submitted URL is analyzed to completion and the report is ready. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      urls:
                        - url: https://click.serpbooster.top/wp-json/wp-mail-smtp/v1/e/ZGF0YSU1QmVtYWlsX2xvZ19pZCU1RD00MzYyMDQmZGF0YSU1QmV2ZW50X3R5cGUlNUQ9Y2xpY2stbGluayZkYXRhJTVCb2JqZWN0X2lkJTVEPTI5ODc3MTQmZGF0YSU1QnVybCU1RD1odHRwcyUyNTNBJTI1MkYlMjUyRmNsaWNrLnNlcnBib29zdGVyLnRvcCUyNTJGJTI1M0ZubHRyJTI1M0RNVFU3TnpNMk1EUXhPMmgwZEhCek9pOHZkM2QzTG5ObGNuQmliMjl6ZEdWeUxuUnZjQzltY21WbExYTmxieTFqYjI1emRXeDBZV2wwYVc5dUx6czdaalpoTkROalpEVmxORFJoTXpoaU5XWmtaVGMzTmpVNU5HUXhaRGhrWkdNJTI1MjUzRCZoYXNoPWQzZDU5NTllNGE4ZTc0NDhiZWZlYzczMzY0MzEyNjkyYzBlOTU2MzU0YjlkOWY1OTQwYjI5ZWUxODg0ZGQ0NWU=
                          analysis_id: 173693484113ac95
                          analysis_time: '2025-01-15T09:54:03'
                          availability_status: online
                          final_url: https://click.serpbooster.top/wp-json/wp-mail-smtp/v1/e/ZGF0YSU1QmVtYWlsX2xvZ19pZCU1RD00MzYyMDQmZGF0YSU1QmV2ZW50X3R5cGUlNUQ9Y2xpY2stbGluayZkYXRhJTVCb2JqZWN0X2lkJTVEPTI5ODc3MTQmZGF0YSU1QnVybCU1RD1odHRwcyUyNTNBJTI1MkYlMjUyRmNsaWNrLnNlcnBib29zdGVyLnRvcCUyNTJGJTI1M0ZubHRyJTI1M0RNVFU3TnpNMk1EUXhPMmgwZEhCek9pOHZkM2QzTG5ObGNuQmliMjl6ZEdWeUxuUnZjQzltY21WbExYTmxieTFqYjI1emRXeDBZV2wwYVc5dUx6czdaalpoTkROalpEVmxORFJoTXpoaU5XWmtaVGMzTmpVNU5HUXhaRGhrWkdNJTI1MjUzRCZoYXNoPWQzZDU5NTllNGE4ZTc0NDhiZWZlYzczMzY0MzEyNjkyYzBlOTU2MzU0YjlkOWY1OTQwYjI5ZWUxODg0ZGQ0NWU=
                      next_page: 1736934846ab647958d7e8eb7fc4f776b3d04579007179660f
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      urls:
                        type: array
                        items:
                          type: object
                          properties:
                            url:
                              type: string
                              description: The submitted URL.
                            final_url:
                              type: string
                              description: The URL that was analyzed after redirecting from the submitted URL.
                            availability_status:
                              type: string
                              description: Indicates whether the analyzed URL was available or not (at the time of the analysis).
                              enum:
                                - online
                                - offline
                            analysis_time:
                              type: string
                              description: Time when the report was generated.
                            analysis_id:
                              type: string
                              description: The unique identifier of the analysis.
                      next_page:
                        type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/networking/url/v1/notifications/query/latest?limit=1' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/networking/url/v1/notifications/query/latest?limit=1"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters: []
  /api/networking/url/v1/notifications/query/latest/page/{page}:
    get:
      summary: 'TCA-0403: URL Threat Intelligence (notifications) (latest) (paginated)'
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-url-v1-notifications-query-latest-paginated
      description: This service provides a continuous list of completed analyses. The records enter the feed once the submitted URL is analyzed to completion and the report is ready. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      urls:
                        - url: https://65.21.186.115/06274c321223c6751cb0a7d9726b4ff3y
                          analysis_id: '1737628407655631'
                          analysis_time: '2025-01-23T10:33:30'
                          availability_status: online
                          final_url: https://65.21.186.115/06274c321223c6751cb0a7d9726b4ff3y
                        - url: https://repo1.maven.org/maven2/dev/lukebemish/crochet/tools/0.1.0-alpha.5/tools-0.1.0-alpha.5-javadoc.jar
                          analysis_id: '1737628417940126'
                          analysis_time: '2025-01-23T10:33:40'
                          availability_status: online
                          final_url: https://repo1.maven.org/maven2/dev/lukebemish/crochet/tools/0.1.0-alpha.5/tools-0.1.0-alpha.5-javadoc.jar
                        - url: https://repo1.maven.org/maven2/dev/lukebemish/taskgraphrunner/0.1.18/taskgraphrunner-0.1.18-signatures-javadoc.jar
                          analysis_id: 17376284179007ca
                          analysis_time: '2025-01-23T10:33:40'
                          availability_status: online
                          final_url: https://repo1.maven.org/maven2/dev/lukebemish/taskgraphrunner/0.1.18/taskgraphrunner-0.1.18-signatures-javadoc.jar
                        - url: https://repo1.maven.org/maven2/dev/lukebemish/crochet/tools/0.1.0-alpha.11/tools-0.1.0-alpha.11.pom
                          analysis_id: '1737628417910936'
                          analysis_time: '2025-01-23T10:33:40'
                          availability_status: online
                          final_url: https://repo1.maven.org/maven2/dev/lukebemish/crochet/tools/0.1.0-alpha.11/tools-0.1.0-alpha.11.pom
                        - url: https://repo1.maven.org/maven2/dev/lukebemish/crochet/tools/0.1.0-alpha.5/tools-0.1.0-alpha.5.module
                          analysis_id: '1737628417892422'
                          analysis_time: '2025-01-23T10:33:40'
                          availability_status: online
                          final_url: https://repo1.maven.org/maven2/dev/lukebemish/crochet/tools/0.1.0-alpha.5/tools-0.1.0-alpha.5.module
                      next_page: 1737628451ff850ab841ed28ef22280c2a63fd4a6f85e051b4
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      urls:
                        type: array
                        items:
                          type: object
                          properties:
                            url:
                              type: string
                              description: The submitted URL.
                            final_url:
                              type: string
                              description: The URL that was analyzed after redirecting from the submitted URL.
                            availability_status:
                              type: string
                              description: Indicates whether the analyzed URL was available or not (at the time of the analysis).
                              enum:
                                - online
                                - offline
                            analysis_time:
                              type: string
                              description: Time when the report was generated.
                            analysis_id:
                              type: string
                              description: The unique identifier of the analysis.
                      next_page:
                        type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/networking/url/v1/notifications/query/latest/page/17557838927eeb310cb92ee290bb3a2c7f22593a211bcbdbc9?limit=1' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/networking/url/v1/notifications/query/latest/page/17557838927eeb310cb92ee290bb3a2c7f22593a211bcbdbc9?limit=1"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - schema:
          type: string
        name: page
        in: path
        required: true
      - $ref: '#/components/parameters/ResponseFormat'
      - name: limit
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 1000
          default: 1000
          example: 50
        description: Specifies the maximum number of reports to return in the response.
  /api/networking/url/v1/analyze/query/{post_format}:
    post:
      summary: 'TCA-0404: Analyze URL'
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-url-v1-analyze-query
      parameters:
        - name: post_format
          in: path
          schema:
            type: string
            enum:
              - xml
              - json
          required: true
          description: Required parameter that defines the POST body format.
        - $ref: '#/components/parameters/PostHeader'
      description: 'This service allows users to submit a URL for analysis. The analysis is a crawling process that will start looking for files to download from the submitted URL. When downloaded, the files are sent for analysis to the ReversingLabs file processing pipeline. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      status: started
                      analysis_id: 1736938889399c17
                      requested_url: http://example.com/
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      status:
                        type: string
                      analysis_id:
                        type: string
                      requested_url:
                        type: string
                    required:
                      - status
                      - analysis_id
                      - requested_url
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: Forbidden. The server understood the request, but is refusing to fulfill it. A possible cause may be that the URL that was sent to analysis is already being analyzed. In this case, the API will also return an "Analysis in progress" message.
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/url/v1/analyze/query/json' --header 'Content-Type: application/json' --user <username>:<password> --data '{
              "rl": {
                "query": {
                  "url": "reversinglabs.com",
                  "response_format": "json"
                }
              }
            }'
        - lang: Python
          source: |
            import requests
            import json
            url = "https://data.reversinglabs.com/api/networking/url/v1/analyze/query/json"
            json = {
              "rl": {
                "query": {
                  "url": "reversinglabs.com",
                  "response_format": "json"
                }
              }
            }
            response = requests.post(url, json=json, auth=('username', 'password'))
            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        url:
                          type: string
                          format: uri
                        response_format:
                          type: string
                          enum:
                            - json
                            - xml
                          default: xml
                        analysis_type:
                          type: string
                          enum:
                            - fileless
                            - light
                          description: Controls content download. By default, the service downloads content from the submitted URL and from URLs found on that page. Use `light` to download only the content from the submitted URL. Use `fileless` to skip downloading content entirely.
                      required:
                        - url
  /api/networking/domain/resolutions/v1/query/{post_format}:
    post:
      summary: TCA-0405 Domain Threat Intelligence (resolutions)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-domain-v1-domain-resolutions-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service provides a list of domain-to-IP mappings for the requested domain. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request was successful.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      resolutions:
                        type: array
                        description: List of domain resolutions.
                        items:
                          type: object
                          properties:
                            record_type:
                              type: string
                              description: Type of DNS record.
                            answer:
                              type: string
                              description: IP address of the domain.
                            provider:
                              type: string
                              description: Provider of the DNS record.
                            last_resolution_time:
                              type: string
                      requested_domain:
                        type: string
                        description: The submitted domain.
                      next_page:
                        type: string
                        description: The next page token to be used in the next request to get the next page of results.
              example:
                rl:
                  query:
                    domain: 530908.selcdn.ru
                    limit: 1000
                    response_format: json
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/domain/resolutions/v1/query/json' --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "domain": "google.com",
                        "response_format": "json",
                        "limit": 1000
                    }
                }
            }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/domain/resolutions/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "domain": "google.com",
                  "response_format": "json",
                  "limit": 1000
                }
              }
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        domain:
                          type: string
                          description: The domain for which to retrieve a list of resolutions.
                        limit:
                          type: integer
                          description: The maximum number of results to return.
                          default: 1000
                        response_format:
                          type: string
                          description: Defines the response format.
                          enum:
                            - json
                            - xml
                          default: xml
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/networking/domain/urls/v1/query/{post_format}:
    post:
      summary: TCA-0405 Domain Threat Intelligence (URLs)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-domain-v1-urls-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service provides a list of URLs associated with the requested domain. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request was successful.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      next_page:
                        type: string
                      requested_domain:
                        type: string
                      urls:
                        type: array
                        items:
                          type: object
                          properties:
                            url:
                              type: string
              example:
                rl:
                  requested_domain: google.com
                  urls:
                    - url: https://google.com/maps/d/viewer?hl=he&ll=32.07101099999999,34.93926999999999&mid=1P253fCyFem5eRIi0OG7yU0s78DA&msa=0&source=embed&spn=0.060586,0.077162&t=m&z=14
                    - url: https://google.com/url?amp;amp;cd=CAEYACoTODg2NDA0MDg5MDE1MTE3Mjk2OTIaZDJiOTI2M2NkNWFkNzNiMjpjb206ZW46VVM&amp;amp;ct=ga&amp;amp;sa=t&amp;amp;url=https://www.servisfirstbank.com/personal-banking/&amp;amp;usg=AFQjCNFA_ViU8EVmuKAmNLSjeJ_X83sFtA&rct=j
                    - url: https://google.com/maps/d/thumbnail?mid=1jyB0rKUSv2bQPG3lk7ifKhQhLdw
                    - url: https://google.com/url?amp;rct=j&amp;source=web&amp;url=https://1islamicknowledge.blogspot.com/2020/04/surah-baqra-hindi-translation-text-mp3.html?m=1&amp;usg=AOvVaw0kFw8Vh_o961cWw1qT3E-x&amp;ved=2ahUKEwifoaiquID1AhXWgtgFHSMTCgUQFnoECA4QAQ&sa=t
                    - url: https://google.com/recaptcha/api.js?render=6Lfhkv0gAAAAAKikYBucy2AUaKJJt0U0fMrZ04Fs
                  next_page: 0001ecc50bed4aceefef8ba0e987f5d42a402856
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/domain/urls/v1/query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "domain": "google.com",
                        "response_format": "json",
                        "limit": 1000
                    }
                }
            }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/domain/urls/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "domain": "google.com",
                  "response_format": "json",
                  "limit": 1000
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        domain:
                          type: string
                          description: The domain for which to retrieve a list of URLs.
                        response_format:
                          type: string
                          description: Defines the response format.
                        limit:
                          type: integer
                          description: The maximum number of results to return.
                          default: 1000
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/networking/domain/related_domains/v1/query/{post_format}:
    post:
      summary: TCA-0405 Domain Threat Intelligence (Related Domains)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-domain-v1-related-domains-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service provides a list of domains that have the same top parent domain as the requested domain. If the requested domain is a top parent domain, the API will return all subdomains. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request was successful.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      next_page:
                        type: string
                        description: The next page token to be used in the next request to get the next page of results.
                      requested_domain:
                        type: string
                        description: The submitted domain.
                      related_domains:
                        type: array
                        description: A list of related domains.
                        items:
                          type: object
                          properties:
                            domain:
                              type: string
              example:
                rl:
                  requested_domain: google.com
                  related_domains:
                    - domain: 457.drive.google.com
                    - domain: mail-qt1-f182.google.com
                    - domain: r5---sn-q4fl6nlz.c.pack.google.com
                    - domain: r1---sn-q4fl6n7s.c.pack.google.com
                    - domain: mail-wr1-f47.google.com
                  next_page: 012e023416001dfc8e442ff7104691e8298ce82e
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --location --request POST 'https://data.reversinglabs.com/api/networking/domain/related_domains/v1/query/json' --user <username>:<password> --header 'Content-Type: application/json' --data-raw '{
             "rl": {
                 "query": {
                     "domain": "google.com",
                     "response_format": "json",
                     "limit": 5,
                     "page": "07c9693a82ee38525a7d75727abfae1bf03d9e31"
                 }
             }
             }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/domain/related_domains/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "domain": "google.com",
                  "response_format": "json",
                  "limit": 5,
                  "page": "07c9693a82ee38525a7d75727abfae1bf03d9e31"
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        domain:
                          type: string
                          description: The domain for which to retrieve the related domains.
                        response_format:
                          type: string
                          description: 'Defines the response format. The following values are supported: xml (default) and json.'
                        limit:
                          type: integer
                          description: The number of related domains to return in the response.
                          default: 1000
                        page:
                          type: string
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/networking/domain/report/v1/query/{post_format}:
    post:
      summary: TCA-0405 Domain Threat Intelligence (report)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-domain-v1-report-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service returns threat intelligence data for the submitted domain. The report contains domain reputation from various reputation sources, classification statistics for files downloaded from the domain, the most common threats found on the domain DNS information about the domain, and parent domain information. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      last_dns_records:
                        type: array
                      third_party_reputations:
                        type: object
                        description: Third party reputation data.
                        properties:
                          item:
                            type: object
                            properties:
                              sources:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    detection:
                                      type: string
                                      description: Detection for the submitted domain. The possible values are malicious/suspicious/clean/undetected. If the source does not have any information about the domain, the value will be undetected.
                                    source:
                                      type: string
                                      description: Name of the third party source.
                                    update_time:
                                      type: string
                                      description: Time when the information from the source was last updated.
                                    detect_time:
                                      type: string
                                      description: Time when the domain was last detected or given a category by the source.
                                    categories:
                                      type: array
                              statistics:
                                type: object
                                properties:
                                  total:
                                    type: integer
                                  malicious:
                                    type: integer
                                  undetected:
                                    type: integer
                                  clean:
                                    type: integer
                      top_threats:
                        type: object
                        properties:
                          item:
                            type: array
                            items:
                              type: object
                              properties:
                                threat_name:
                                  type: string
                                  description: Name of the specific threat that was found.
                                threat_level:
                                  type: integer
                                  description: Threat level based on threat_name.
                                files_count:
                                  type: integer
                                  description: The number of files classified as that threat.
                      last_seen:
                        type: string
                        description: The last time when the requested domain received an indicator that updated its report. This can be the last time when we checked the domain reputation against third-party sources, the last time we obtained metadata for the requested domain from ReversingLabs static/dynamic file processing services (related files), or the last time the requested domain has been crawled or analyzed by the ReversingLabs Cloud Sandbox.
                      modified_time:
                        type: string
                        description: The last time when the requested domain received an indicator that updated its report. This can be the last time when we checked the domain reputation against third-party sources, the last time we obtained metadata for the requested domain from ReversingLabs static/dynamic file processing services (related files), or the last time the requested domain has been crawled or analyzed by the ReversingLabs Cloud Sandbox.
                        deprecated: true
                      downloaded_files_statistics:
                        type: object
                        properties:
                          item:
                            type: object
                            properties:
                              known:
                                type: integer
                              unknown:
                                type: integer
                              suspicious:
                                type: integer
                              total:
                                type: integer
                              malicious:
                                type: integer
                      parent_domain:
                        type: string
                        description: TLD of the submitted domain. Only returned for domains which are not TLD.
                      requested_domain:
                        type: object
                        properties:
                          item:
                            type: string
                      certificates:
                        type: array
                        items:
                          type: object
                          properties:
                            valid_from:
                              type: string
                              description: Start date of the certificate’s validity.
                              format: date-time
                            valid_to:
                              type: string
                              description: Expiration date of the certificate.
                              format: date-time
                            version:
                              type: string
                              description: X.509 version of the certificate.
                            signature_algorithm:
                              type: string
                              description: Algorithm used to sign the certificate.
                            signature:
                              type: string
                              description: The digital signature for the certificate.
                            serial_number:
                              type: string
                              description: Serial number of the certificate.
                            common_name:
                              type: string
                              description: Common Name (CN) for which the certificate is issued.
                            issuer:
                              type: string
                              description: Name of the Certificate Authority that issued the certificate.
                            certificate_thumbprints:
                              type: array
                              description: An array of thumbprints for the certificate in MD5, SHA1, and SHA256 formats.
                              items:
                                type: object
                                properties:
                                  name:
                                    type: string
                                    description: Name of the extension.
                                  value:
                                    type: string
                                    description: Extension value content.
                            extensions:
                              type: array
                              description: X.509 certificate extensions.
                              items:
                                type: object
                                properties:
                                  is_critical:
                                    type: string
                                  name:
                                    type: string
                                  value:
                                    type: string
              example:
                rl:
                  requested_domain: google.com
                  third_party_reputations:
                    statistics:
                      malicious: 2
                      clean: 0
                      suspicious: 0
                      undetected: 10
                      total: 12
                    sources:
                      - source: apwg
                        update_time: '2025-01-15T05:57:19'
                        detection: malicious
                        categories: []
                        detect_time: '2023-11-02T16:57:30'
                      - source: botvrij
                        update_time: '2025-01-15T02:25:17'
                        detection: undetected
                      - source: osint
                        update_time: '2025-01-15T01:31:01'
                        detection: undetected
                      - source: cyradar
                        update_time: '2025-01-15T01:29:02'
                        detection: undetected
                  downloaded_files_statistics:
                    unknown: 831
                    known: 559815
                    suspicious: 0
                    malicious: 320
                    total: 560966
                  last_dns_records:
                    - type: A
                      value: 0.0.0.0
                      provider: ReversingLabs
                    - type: AAAA
                      value: 2a00:1450:400d:80d::200e
                      provider: ReversingLabs
                    - type: TXT
                      value: '"facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95"'
                      provider: ReversingLabs
                    - type: NS
                      value: ns4.google.com
                      provider: ReversingLabs
                    - type: MX
                      value: smtp.google.com
                      provider: ReversingLabs
                  top_threats:
                    - threat_name: Script-JS.Adware.Popunder
                      threat_level: 1
                      files_count: 304
                    - threat_name: Script-JS.Phishing.Acsogenixx
                      threat_level: 5
                      files_count: 7
                    - threat_name: Document-HTML.Phishing.PhishHtml
                      threat_level: 5
                      files_count: 1
                    - threat_name: Document-PDF.Phishing.Generic
                      threat_level: 5
                      files_count: 1
                    - threat_name: Document-HTML.Trojan.ClickFix
                      threat_level: 5
                      files_count: 1
                  last_dns_records_time: '2025-01-15T11:04:01'
                  last_seen: '2025-01-15T11:08:30'
                  modified_time: '2025-01-15T11:08:30'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/domain/report/v1/query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "domain": "530908.selcdn.ru",
                        "response_format": "json"
                    }
                }
            }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/domain/report/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "domain": "530908.selcdn.ru",
                  "response_format": "json"
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        domain:
                          type: string
                          description: The domain for which to retrieve a list of files.
                        response_format:
                          type: string
                          description: Defines the response format.
                          enum:
                            - json
                            - xml
                          default: xml
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/networking/domain/report/v1/bulk_query/{post_format}:
    post:
      summary: TCA-0405 Domain Threat Intelligence (report) (bulk)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-domain-v1-report-bulk_query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service returns threat intelligence data for the submitted domains. The report for each contains domain reputation from various reputation sources, classification statistics for files downloaded from the domain, the most common threats found on the domain DNS information about the domain, and parent domain information. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            last_dns_records:
                              type: array
                            third_party_reputations:
                              type: object
                              properties:
                                item:
                                  type: object
                                  properties:
                                    sources:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          detection:
                                            type: string
                                            description: Detection for the submitted domain. The possible values are malicious/suspicious/clean/undetected. If the source does not have any information about the domain, the value will be undetected.
                                          source:
                                            type: string
                                            description: Name of the third party source.
                                          update_time:
                                            type: string
                                            description: Time when the information from the source was last updated.
                                          detect_time:
                                            type: string
                                            description: Time when the domain was last detected or given a category by the source.
                                          categories:
                                            type: array
                                    statistics:
                                      type: object
                                      properties:
                                        total:
                                          type: integer
                                        malicious:
                                          type: integer
                                        undetected:
                                          type: integer
                                        clean:
                                          type: integer
                            top_threats:
                              type: object
                              properties:
                                item:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      threat_name:
                                        type: string
                                        description: Name of the specific threat that was found
                                      threat_level:
                                        type: integer
                                        description: Threat level based on threat_name.
                                      files_count:
                                        type: integer
                                        description: The number of files classified as that threat.
                            last_seen:
                              type: string
                              description: The last time when the requested domain received an indicator that updated its report. This can be the last time when we checked the domain reputation against third-party sources, the last time we obtained metadata for the requested domain from ReversingLabs static/dynamic file processing services (related files), or the last time the requested domain has been crawled or analyzed by the ReversingLabs Cloud Sandbox.
                            modified_time:
                              type: string
                              description: The last time when the requested domain received an indicator that updated its report. This can be the last time when we checked the domain reputation against third-party sources, the last time we obtained metadata for the requested domain from ReversingLabs static/dynamic file processing services (related files), or the last time the requested domain has been crawled or analyzed by the ReversingLabs Cloud Sandbox.
                              deprecated: true
                            downloaded_files_statistics:
                              type: object
                              properties:
                                item:
                                  type: object
                                  properties:
                                    known:
                                      type: integer
                                    unknown:
                                      type: integer
                                    suspicious:
                                      type: integer
                                    total:
                                      type: integer
                                    malicious:
                                      type: integer
                            parent_domain:
                              type: string
                              description: TLD of the submitted domain. Only returned for domains which are not TLD.
                            requested_domain:
                              type: object
                              description: The submitted domain.
                              properties:
                                item:
                                  type: string
                            certificates:
                              type: array
                              description: An object containing information about the SSL/TLS certificates associated with the requested domain, listed by port number (e.g., 443). Each certificate entry includes metadata such as validity dates, version, signature algorithm, issuer, common name, serial number, thumbprints (MD5, SHA1, SHA256), and a list of certificate extensions with their criticality and values.
                              items:
                                type: object
                                properties:
                                  valid_from:
                                    type: string
                                    description: Start date of the certificate's validity.
                                    format: date-time
                                  valid_to:
                                    type: string
                                    description: Expiration date of the certificate.
                                    format: date-time
                                  version:
                                    type: string
                                    description: X.509 version of the certificate.
                                  signature_algorithm:
                                    type: string
                                    description: Algorithm used to sign the certificate.
                                  signature:
                                    type: string
                                    description: The digital signature for the certificate.
                                  serial_number:
                                    type: string
                                    description: Serial number of the certificate.
                                  common_name:
                                    type: string
                                    description: Common Name (CN) for which the certificate is issued.
                                  issuer:
                                    type: string
                                    description: Name of the Certificate Authority that issued the certificate.
                                  certificate_thumbprints:
                                    type: array
                                    description: An array of thumbprints for the certificate in MD5, SHA1, and SHA256 formats.
                                    items:
                                      type: object
                                      properties:
                                        name:
                                          type: string
                                          description: Hashing algorithm used.
                                        value:
                                          type: string
                                          description: The thumbprint value.
                                  extensions:
                                    type: array
                                    description: X.509 certificate extensions.
                                    items:
                                      type: object
                                      properties:
                                        is_critical:
                                          type: string
                                          description: Indicates if the extension is marked critical.
                                        name:
                                          type: string
                                          description: Name of the extension.
                                        value:
                                          type: string
                                          description: Extension value content.
              example:
                rl:
                  requested_domain: google.com
                  third_party_reputations:
                    statistics:
                      malicious: 2
                      clean: 0
                      suspicious: 0
                      undetected: 10
                      total: 12
                    sources:
                      - source: apwg
                        update_time: '2025-01-15T05:57:19'
                        detection: malicious
                        categories: []
                        detect_time: '2023-11-02T16:57:30'
                      - source: botvrij
                        update_time: '2025-01-15T02:25:17'
                        detection: undetected
                      - source: osint
                        update_time: '2025-01-15T01:31:01'
                        detection: undetected
                      - source: cyradar
                        update_time: '2025-01-15T01:29:02'
                        detection: undetected
                  downloaded_files_statistics:
                    unknown: 831
                    known: 559815
                    suspicious: 0
                    malicious: 320
                    total: 560966
                  last_dns_records:
                    - type: A
                      value: 0.0.0.0
                      provider: ReversingLabs
                    - type: AAAA
                      value: 2a00:1450:400d:80d::200e
                      provider: ReversingLabs
                    - type: TXT
                      value: '"facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95"'
                      provider: ReversingLabs
                    - type: NS
                      value: ns4.google.com
                      provider: ReversingLabs
                    - type: MX
                      value: smtp.google.com
                      provider: ReversingLabs
                  top_threats:
                    - threat_name: Script-JS.Adware.Popunder
                      threat_level: 1
                      files_count: 304
                    - threat_name: Script-JS.Phishing.Acsogenixx
                      threat_level: 5
                      files_count: 7
                    - threat_name: Document-HTML.Phishing.PhishHtml
                      threat_level: 5
                      files_count: 1
                    - threat_name: Document-PDF.Phishing.Generic
                      threat_level: 5
                      files_count: 1
                    - threat_name: Document-HTML.Trojan.ClickFix
                      threat_level: 5
                      files_count: 1
                  last_dns_records_time: '2025-01-15T11:04:01'
                  last_seen: '2025-01-15T11:08:30'
                  modified_time: '2025-01-15T11:08:30'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/domain/report/v1/bulk_query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "domains": [
                            "530908.selcdn.ru",
                            "example2.com"
                        ],
                        "response_format": "json"
                    }
                }
            }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/domain/report/v1/bulk_query/json"

            json = {
              "rl": {
                "query": {
                  "domains": [
                    "530908.selcdn.ru",
                    "example2.com"
                  ],
                  "response_format": "json"
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        domains:
                          type: array
                          description: The domains for which to retrieve the report. The limit is 100 domains per request.
                          items:
                            type: string
                        response_format:
                          type: string
                          description: 'Defines the response format. The following values are supported: xml (default) and json.'
                          enum:
                            - json
                            - xml
                          default: xml
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/networking/domain/downloaded_files/v1/query/{post_format}:
    post:
      summary: TCA-0405 Domain Threat Intelligence (downloaded files)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-domain-v1-downloaded_files-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service provides a list of hashes for files downloaded from the submitted domain. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      requested_domain:
                        type: string
                        description: The submitted domain.
                      downloaded_files:
                        type: array
                        description: A list of files and their metadata.
                        items:
                          type: object
                          properties:
                            first_download:
                              type: string
                              description: Time when the file was first downloaded from the requested domain (UTC).
                            threat_level:
                              type: integer
                              description: Malware severity indicator for suspicious and malicious samples, expressed as an integer between 0 and 5, where 5 indicates the most dangerous threats (highest severity). Applies to malicious and suspicious samples only
                            classification:
                              type: string
                              description: 'The classification of the file based on the ReversingLabs proprietary algorithm. The possible values are: malicious, suspicious, known, and unknown.'
                            threat_name:
                              type: string
                              description: Standardized malware name indicating the type, platform, and family of the threat associated with the file. Conforms to the ReversingLabs malware naming standard. Applies to malicious and suspicious files only
                            subplatform:
                              type: string
                              description: The subplatform targeted by the malware.
                            last_seen:
                              type: string
                              description: The last time when the file received impactful changes that updated its threat intelligence report. (UTC)
                            sample_type:
                              type: string
                              description: File type, as detected by Spectra Core.
                            last_download_url:
                              type: string
                              description: File type, as detected by Spectra Core.
                            sample_size:
                              type: integer
                              description: File size (in bytes).
                            sample_available:
                              type: boolean
                              description: Indicates whether the sample is present in the ReversingLabs storage and available for download (true) or not (false).
                            sha1:
                              type: string
                              description: The SHA1 hash of the file.
                            platform:
                              type: string
                              description: The platform targeted by the malware.
                            last_download:
                              type: string
                              description: Time when the file was last downloaded from the requested domain (UTC).
                            malware_type:
                              type: string
                              description: The type part of the full threat name detected for the sample (for example, Trojan, Adware, Rootkit...). Conforms to the ReversingLabs malware naming standard. Applies to malicious and suspicious samples only
                            first_seen:
                              type: string
                              description: Time when the sample was first seen in the ReversingLabs system (UTC).
                            sha256:
                              type: string
                              description: The SHA256 hash of the file.
                            trust_factor:
                              type: integer
                              description: Trustworthiness indicator for known samples, expressed as an integer between 0 and 5, where 0 indicates the most trusted samples (highest confidence). Applies to known samples only.
                            malware_family:
                              type: string
                              description: The familyname part of the full threat name detected for the sample (for example, Marsdaemon, Orcus, Androrat...). Applies to malicious and suspicious samples only.
                            md5:
                              type: string
                              description: The MD5 hash of the file.
              example:
                rl:
                  requested_domain: google.com
                  downloaded_files:
                    - sha1: 0161a08778b568ea3f6ec4ad01d04b367b1d53ba
                      last_download_url: https://google.com/search?q=site:socialgirls.im+hee91914
                      classification: MALICIOUS
                      first_download: '2024-04-23T15:40:29'
                      last_download: '2024-04-23T15:40:29'
                      threat_name: Script-JS.Adware.Popunder
                      threat_level: 1
                      trust_factor: 5
                      malware_family: Popunder
                      malware_type: Adware
                      platform: Script
                      subplatform: JS
                      first_seen: '2024-04-23T14:40:32'
                      last_seen: '2025-01-14T00:21:13'
                      sample_available: true
                      md5: 18c8b9b1cd7b4e2d026884f172febdc2
                      sample_size: 37006
                      sample_type: Text/HTML/HTML
                      sha256: 5ef39ae5ce2fa3d34a147507b97b83479aeab6adbaef3ca890d46ef285d4021f
                  next_page: 0177e1e2581158cc204b7fbb0fba178a3ec7ef4a
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/domain/downloaded_files/v1/query/json' --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "domain": "google.com",
                        "limit": 1000,
                        "response_format": "json",
                        "extended": true,
                        "classification": "KNOWN"
                    }
                }
            }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/domain/downloaded_files/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "domain": "google.com",
                  "response_format": "json",
                  "limit": 2
                }
              }
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        domain:
                          type: string
                          description: The domain for which to retrieve the report.
                        limit:
                          type: integer
                          description: The number of files to return in the response.
                          default: 1000
                        extended:
                          type: boolean
                          description: Allows choosing between true - extended, and false - non-extended data set (default).
                        classification:
                          type: string
                          description: 'If this parameter is provided in the request, the response will contain only samples that match the requested classification. Supported values are: KNOWN, SUSPICIOUS, MALICIOUS, UNKNOWN'
                        response_format:
                          type: string
                          description: 'Defines the response format. The following values are supported: xml (default) and json.'
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/networking/ip/resolutions/v1/query/{post_format}:
    post:
      summary: TCA-0406 IP Threat Intelligence (resolutions)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-ip-v1-ip-resolutions-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service provides a list of IP-to-domain mappings for the specified IP. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request was successful.
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      requested_ip:
                        type: string
                        description: The submitted IP.
                      resolutions:
                        type: array
                        description: List of associated resolutions.
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - host_name
                            - time
                            - provider
                      next_page:
                        type: string
                        description: The next page token to be used in the next request to get the next page of results.
                    required:
                      - requested_ip
                      - resolutions
                      - next_page
                required:
                  - rl
              example:
                rl:
                  requested_ip: 151.139.128.10
                  resolutions:
                    - host_name: fi.werk.eu
                      last_resolution_time: '2023-03-02T04:41:51'
                      provider: ReversingLabs
                    - host_name: dancvrcek.com
                      last_resolution_time: '2023-05-07T23:51:12'
                      provider: ReversingLabs
                    - host_name: pomonaks.org
                      last_resolution_time: '2023-01-31T07:45:37'
                      provider: ReversingLabs
                    - host_name: library.fuckswipe.com
                      last_resolution_time: '2023-03-05T16:18:40'
                      provider: ReversingLabs
                    - host_name: thealliancedc.com
                      last_resolution_time: '2023-06-18T00:43:43'
                      provider: ReversingLabs
                  next_page: 0d046828999bfdaa2a2d82b5cdfe58e197c95b7d
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/ip/resolutions/v1/query/json' --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "ip": "104.19.138.57",
                        "response_format": "json",
                        "limit": 1000
                    }
                }
            }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/ip/resolutions/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "ip": "104.19.138.57",
                  "response_format": "json",
                  "limit": 1000
                }
              }
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        ip:
                          type: string
                          description: The IP for which to retrieve the report.
                        limit:
                          type: integer
                          description: The maximum number of results to return.
                          default: 1000
                        response_format:
                          type: string
                          description: Defines the response format.
                          enum:
                            - json
                            - xml
                          default: xml
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/networking/ip/urls/v1/query/{post_format}:
    post:
      summary: TCA-0406 IP Threat Intelligence (URLs)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-ip-v1-urls-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service provides a list of URLs associated with the requested IP. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request was successful.
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      requested_ip:
                        type: string
                        description: The submitted IP.
                      urls:
                        type: array
                        description: List of associated URLs.
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - url
                            - time
                            - provider
                      next_page:
                        type: string
                        description: The next page token to be used in the next request to get the next page of results.
                    required:
                      - requested_ip
                      - urls
                      - next_page
                required:
                  - rl
              example:
                rl:
                  requested_ip: 37.34.248.24
                  urls:
                    - url: http://tzgl.org/fhsgtsspen6/get.php?first=true&pid=80FF226E0E7A2F5CBB103F301B8496F4
                    - url: http://cabrioxmdes.at/images/wOQIwCR9V2g3SkTo/_2BCgw3GjklAQWa/85AjE7UuiwQ_2BLv5c/_2FigYOJe/oFssg1JDtvmNWy3cgLGW/UtFXRWnx_2BbkiPQ7ka/N1gOMDwHBrE7UQfHBN087E/X4ooaH7eW4tEU/73FajTAU/pgAXOK6FMXY8PtbAYsmlWKp/AtW9mLp8bl/AdDNljWQpA1vYR5go/W5IHpgTYWklJ/X9sj3uUEaaq/p_2BUHHSzBJ5XT/XEOB3uvlXPYR2o0k_2FfC/aG_2B8JNJUyqvUot/EfIQb_2BNAuMapC/qAfntlZ6yA_2F5c_2F_2/F.jpeg
                    - url: http://winnlinne.com/test1/get.php?pid=58EA1B166BC3A785C345B5D0FB431CDE
                    - url: https://abibiall.com/test2/get.php?first=true&pid=D2A34488191DA742578166D02E2C8607
                    - url: http://winnlinne.com/test3/get.php?pid=2A72E669EA58BE5EC0C32CD740F0F1B8
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/ip/urls/v1/query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "ip": "104.19.138.57",
                        "response_format": "json",
                        "limit": 1000
                    }
                }
            }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/ip/urls/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "ip": "104.19.138.57",
                  "response_format": "json",
                  "limit": 1000
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        ip:
                          type: string
                          description: The IP for which to retrieve the report.
                        limit:
                          type: integer
                          description: The maximum number of results to return.
                          default: 1000
                        response_format:
                          type: string
                          description: Defines the response format.
                          enum:
                            - json
                            - xml
                          default: xml
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/networking/ip/report/v1/query/{post_format}:
    post:
      summary: TCA-0406 IP Threat Intelligence (report)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-ip-v1-report-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
        - name: extended
          in: query
          description: If true, includes WHOIS registration data for the submitted IP.
          required: false
          schema:
            type: boolean
            default: false
      description: This service returns threat intelligence data for the submitted IP. The report contains IP reputation from various reputation sources, classification statistics for files downloaded from the IP, and the top threats hosted on the submitted IP. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      requested_ip:
                        type: string
                        description: The submitted IP.
                      first_seen:
                        type: string
                        format: date-time
                        description: Timestamp when the IP was first seen.
                      third_party_reputations:
                        type: object
                        description: Third party reputation data.
                        properties:
                          statistics:
                            type: object
                            required:
                              - total
                              - malicious
                              - clean
                              - undetected
                            properties:
                              total:
                                type: number
                              malicious:
                                type: number
                              clean:
                                type: number
                              undetected:
                                type: number
                          sources:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              properties:
                                source:
                                  type: string
                                  description: Name of the third party source
                                update_time:
                                  type: string
                                detection:
                                  type: string
                                  description: Detection for the submitted IP. The possible values are malicious/suspicious/clean/undetected. If the source does not have any information about the IP, the value will be undetected.
                                detect_time:
                                  type: string
                                  description: Time when the IP was last detected or given a category by the source.
                                categories:
                                  type: string
                                  description: IP categorization according to the source, e.g. phishing. Not all sources provide categorization information.
                              required:
                                - source
                                - update_time
                                - detection
                                - detect_time
                                - categories
                          whois:
                            type: array
                            description: |
                              Optional. Contains WHOIS registration data for the submitted IP address. Each object represents a WHOIS record retrieved from regional registries (e.g., RIPE, ARIN, APNIC). Field structure varies by source. Users should not rely on a fixed schema.
                            items:
                              type: object
                              additionalProperties: true
                        required:
                          - statistics
                          - sources
                      geoip:
                        type: object
                        description: |
                          Optional. Contains geographic location information for the submitted IP address. Only returned when extended=true is requested. GeoIP data is provided by [DB-IP](https://db-ip.com).
                        properties:
                          as:
                            type: string
                            description: Autonomous System Number for the IP address.
                          as_org:
                            type: string
                            description: Organization name associated with the Autonomous System.
                          network:
                            type: string
                            description: CIDR notation of the network block containing the IP.
                          location:
                            type: object
                            description: Geographic location details.
                            properties:
                              city:
                                type: string
                                description: City where the IP is geographically located.
                              country:
                                type: object
                                properties:
                                  iso_code:
                                    type: string
                                    description: ISO 3166-1 alpha-2 country code.
                              latitude:
                                type: number
                                description: Geographic latitude coordinate.
                              longitude:
                                type: number
                                description: Geographic longitude coordinate.
                      downloaded_files_statistics:
                        type: object
                        properties:
                          suspicious:
                            type: number
                          unknown:
                            type: number
                          known:
                            type: number
                          malicious:
                            type: number
                          total:
                            type: number
                        required:
                          - suspicious
                          - unknown
                          - known
                          - malicious
                          - total
                      top_threats:
                        type: array
                        description: Top 5 threats found on the domain.
                        uniqueItems: true
                        minItems: 1
                        items:
                          type: object
                          properties:
                            threat_name:
                              type: string
                              description: Name of the specific threat that was found.
                            threat_level:
                              type: number
                              description: Threat level based on threat_name.
                            files_count:
                              type: number
                              description: The number of files classified as that threat.
                          required:
                            - threat_name
                            - threat_level
                            - files_count
                      last_seen:
                        type: string
                        description: The last time when the requested domain received an indicator that updated its report. This can be the last time when we checked the domain reputation against third-party sources, the last time we obtained metadata for the requested domain from ReversingLabs static/dynamic file processing services (related files), or the last time the requested domain has been crawled or analyzed by the ReversingLabs Cloud Sandbox.
                      modified_time:
                        type: string
                        description: The last time when the requested domain received an indicator that updated its report. This can be the last time when we checked the domain reputation against third-party sources, the last time we obtained metadata for the requested domain from ReversingLabs static/dynamic file processing services (related files), or the last time the requested domain has been crawled or analyzed by the ReversingLabs Cloud Sandbox.
                        deprecated: true
                required:
                  - rl
              example:
                rl:
                  requested_ip: 151.139.128.10
                  third_party_reputations:
                    statistics:
                      malicious: 2
                      clean: 0
                      suspicious: 0
                      undetected: 9
                      total: 11
                    sources:
                      - source: osint
                        update_time: '2025-01-15T01:31:01'
                        detection: undetected
                      - source: threatfox_abuse_ch
                        update_time: '2025-01-15T08:19:51'
                        detection: undetected
                      - source: cyren
                        update_time: '2025-01-15T09:04:04'
                        detection: malicious
                        categories:
                          - phishing
                        detect_time: '2024-08-30T08:01:02'
                      - source: cyradar
                        update_time: '2025-01-15T01:29:02'
                        detection: malicious
                        categories:
                          - phishing
                        detect_time: '2024-03-30T17:52:50'
                      - source: blocklist_de
                        update_time: '2025-01-15T00:26:13'
                        detection: undetected
                      - source: apwg
                        update_time: '2025-01-15T09:23:44'
                        detection: undetected
                      - source: crdf
                        update_time: '2025-01-15T09:29:22'
                        detection: undetected
                      - source: adminus_labs
                        update_time: '2025-01-15T09:58:10'
                        detection: undetected
                        categories: []
                        detect_time: '2024-02-19T13:52:29'
                  downloaded_files_statistics:
                    unknown: 23
                    known: 193682
                    suspicious: 9
                    malicious: 2347
                    total: 196061
                  last_seen: '2025-01-15T09:23:32'
                  modified_time: '2025-01-15T09:23:32'
                  top_threats:
                    - threat_name: Document-PDF.Phishing.Generic
                      files_count: 1468
                      threat_level: 5
                    - threat_name: Document-PDF.Trojan.Heuristic
                      files_count: 185
                      threat_level: 2
                    - threat_name: Script-JS.Trojan.Injected
                      files_count: 149
                      threat_level: 5
                    - threat_name: Script-JS.Trojan.Cryxos
                      files_count: 131
                      threat_level: 5
                    - threat_name: Script-JS.Trojan.Heuristic
                      files_count: 92
                      threat_level: 2
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/ip/report/v1/query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "ip": "104.19.138.57",
                        "response_format": "json"
                    }
                }
            }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/ip/report/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "ip": "104.19.138.57",
                  "response_format": "json"
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        ip:
                          type: string
                        response_format:
                          type: string
                          description: Defines the response format.
                          enum:
                            - json
                            - xml
                          default: xml
                      required:
                        - ip
  /api/networking/ip/report/v1/bulk_query/{post_format}:
    post:
      summary: TCA-0406 IP Threat Intelligence (report) (bulk)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-ip-v1-report-bulk-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service returns threat intelligence data for the submitted IPs. The report for each contains IP reputation from various reputation sources, classification statistics for files downloaded from the IP, and the top threats hosted on the submitted IP. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      entries:
                        type: array
                        items:
                          type: object
                          properties:
                            requested_ip:
                              type: string
                            third_party_reputations:
                              type: object
                              properties:
                                statistics:
                                  type: object
                                  required:
                                    - total
                                    - malicious
                                    - clean
                                    - undetected
                                  properties:
                                    total:
                                      type: number
                                    malicious:
                                      type: number
                                    clean:
                                      type: number
                                    undetected:
                                      type: number
                                sources:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    type: object
                                    properties:
                                      source:
                                        type: string
                                      update_time:
                                        type: string
                                        description: Time when the information from the source was last updated
                                      detection:
                                        type: string
                                        description: Detection for the submitted domain. The possible values are malicious/suspicious/clean/undetected. If the source does not have any information about the domain, the value will be undetected.
                                      detect_time:
                                        type: string
                                        description: Time when the domain was last detected or given a category by the source.
                                      categories:
                                        type: string
                                        description: Domain categorization according to the source, e.g. phishing. Not all sources provide categorization information.
                                    required:
                                      - source
                                      - update_time
                                      - detection
                                      - detect_time
                                      - categories
                              required:
                                - statistics
                                - sources
                            downloaded_files_statistics:
                              type: object
                              properties:
                                suspicious:
                                  type: number
                                unknown:
                                  type: number
                                known:
                                  type: number
                                malicious:
                                  type: number
                                total:
                                  type: number
                              required:
                                - suspicious
                                - unknown
                                - known
                                - malicious
                                - total
                            top_threats:
                              type: array
                              description: Top 5 threats found on the domain.
                              uniqueItems: true
                              minItems: 1
                              items:
                                type: object
                                properties:
                                  threat_name:
                                    type: string
                                    description: Name of the specific threat that was found.
                                  threat_level:
                                    type: number
                                    description: Threat level based on threat_name.
                                  files_count:
                                    type: number
                                    description: The number of files classified as that threat.
                                required:
                                  - threat_name
                                  - threat_level
                                  - files_count
                            last_seen:
                              type: string
                              description: Time when the sample was last seen in the ReversingLabs system (UTC).
                            modified_time:
                              type: string
                              description: Time when the sample was last seen in the ReversingLabs system (UTC).
                              deprecated: true
                required:
                  - rl
              example:
                rl:
                  entries:
                    - requested_ip: 142.250.180.228
                      third_party_reputations:
                        statistics:
                          malicious: 0
                          clean: 0
                          suspicious: 0
                          undetected: 12
                          total: 12
                        sources:
                          - source: ''
                            update_time: '2025-06-18T07:19:53'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-17T22:30:22'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-18T04:28:23'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-18T00:30:57'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-18T07:31:56'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-17T20:24:33'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-18T00:28:14'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-18T07:27:39'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-17T23:26:13'
                            detection: undetected
                      downloaded_files_statistics:
                        unknown: 0
                        known: 93802
                        suspicious: 0
                        malicious: 1
                        total: 93803
                      last_seen: '2025-06-18T02:31:49'
                      modified_time: '2025-06-18T02:31:49'
                      first_seen: '2021-10-20T19:52:28'
                      top_threats:
                        - threat_name: Image-JPEG.Trojan.IFramer
                          files_count: 1
                          threat_level: 5
                    - requested_ip: 151.139.128.10
                      third_party_reputations:
                        statistics:
                          malicious: 2
                          clean: 0
                          suspicious: 0
                          undetected: 10
                          total: 12
                        sources:
                          - source: ''
                            update_time: '2025-06-18T07:31:56'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-18T07:59:51'
                            detection: malicious
                            categories:
                              - phishing
                            detect_time: '2024-08-30T08:01:02'
                          - source: ''
                            update_time: '2025-06-18T07:19:53'
                            detection: undetected
                          - source: ''
                            update_time: '2025-06-18T00:28:14'
                            detection: malicious
                            categories:
                              - phishing
                            detect_time: '2024-03-30T17:52:50'
                          - source: ''
                            update_time: '2025-06-17T22:30:22'
                            detection: undetected
                      downloaded_files_statistics:
                        unknown: 23
                        known: 193883
                        suspicious: 8
                        malicious: 2348
                        total: 196262
                      last_seen: '2025-06-18T09:38:41'
                      modified_time: '2025-06-18T09:38:41'
                      first_seen: '2022-10-26T05:15:06'
                      top_threats:
                        - threat_name: Document-PDF.Phishing.Generic
                          files_count: 1463
                          threat_level: 5
                        - threat_name: Document-PDF.Trojan.Heuristic
                          files_count: 157
                          threat_level: 2
                        - threat_name: Script-JS.Trojan.Injected
                          files_count: 150
                          threat_level: 5
                        - threat_name: Script-JS.Trojan.Cryxos
                          files_count: 130
                          threat_level: 5
                        - threat_name: Script-JS.Trojan.Heuristic
                          files_count: 126
                          threat_level: 2
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/ip/report/v1/bulk_query/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "ips": [
                            "104.19.138.57",
                            "151.101.1.57"
                        ],
                        "response_format": "json"
                    }
                }
            }'
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/ip/report/v1/bulk_query/json"

            json = {
              "rl": {
                "query": {
                  "ips": [
                    "104.19.138.57",
                    "151.101.1.57"
                  ],
                  "response_format": "json"
                }
              }
            }

            response = requests.post(url, auth=('username', 'password'), json=json)

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        ips:
                          type: array
                          description: The IPs for which to retrieve the report. The limit is 100 IPs per request.
                          items:
                            type: string
                        response_format:
                          type: string
                          description: 'Defines the response format. Supported values: `xml` or `json`.'
                          enum:
                            - json
                            - xml
                          default: xml
                      required:
                        - url
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
  /api/networking/ip/downloaded_files/v1/query/{post_format}:
    post:
      summary: TCA-0406 IP Threat Intelligence (downloaded files)
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-ip-v1-downloaded_files-query
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: This service provides a list of hashes for files downloaded from the submitted IP address. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      requested_ip:
                        type: string
                      downloaded_files:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - sha1
                            - last_download_url
                            - classification
                          properties:
                            sha1:
                              type: string
                            last_download_url:
                              type: string
                              description: The URL from which the file was last downloaded
                            classification:
                              type: string
                              description: 'File classification. Can be one of the following: KNOWN, MALICIOUS, SUSPICIOUS, UNKNOWN'
                            md5:
                              type: string
                              description: MD5 hash of the file.
                            sha256:
                              type: string
                              description: SHA256 hash of the file.
                            first_download:
                              type: string
                              description: The first time the file was downloaded from the IP address.
                            last_download:
                              type: string
                              description: The last time the file was downloaded from the IP address.
                            sample_available:
                              type: boolean
                              description: Indicates if a sample is available for the file.
                            trust_factor:
                              type: number
                              description: The trust factor of the file.
                            threat_level:
                              type: number
                              description: The threat level of the file.
                            threat_name:
                              type: string
                              description: The threat name of the file.
                            malware_family:
                              type: string
                              description: The familyname part of the full threat name detected for the sample (for example, Marsdaemon, Orcus, Androrat...). Applies to malicious and suspicious samples only
                            malware_type:
                              type: string
                              description: The type part of the full threat name detected for the sample (for example, Trojan, Adware, Rootkit...). Conforms to the ReversingLabs malware naming standard. Applies to malicious and suspicious samples only.
                            platform:
                              type: string
                              description: The platform targeted by the malware.
                            subplatform:
                              type: string
                              description: The subplatform targeted by the malware.
                            sample_type:
                              type: string
                              description: File type, as detected by Spectra Core.
                            sample_size:
                              type: number
                              description: File size (in bytes).
                            first_seen:
                              type: string
                              description: Time when the sample was first seen in the ReversingLabs system (UTC).
                            last_seen:
                              type: string
                              description: The last time when the file received impactful changes that updated its threat intelligence report. (UTC)
                    required:
                      - requested_ip
                      - downloaded_files
                required:
                  - rl
              example:
                rl:
                  requested_ip: 104.19.138.57
                  downloaded_files:
                    - sha1: 0035bd7153d5c4fdaf56d11ca48211037f8a5ecd
                      last_download_url: http://index.hr/magazin
                      classification: KNOWN
                    - sha1: 0039e262e9b37a07ff8b88827317fb56b6091260
                      last_download_url: https://index.hr/shopping
                      classification: KNOWN
                    - sha1: 006d2b643a12f61cfa5adfd5ba32897109f590af
                      last_download_url: https://index.hr/
                      classification: KNOWN
                    - sha1: 0075dffd5874e7a9dd64548019250b50e586203c
                      last_download_url: https://index.hr/
                      classification: KNOWN
                    - sha1: 00763e16830ea6fc20232dfbc6e3e6ad1ef484a4
                      last_download_url: http://index.hr/shopping
                      classification: KNOWN
                  next_page: 3aa6883af49bfa47268fd6b3e319344a6b2d9f53
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/ip/downloaded_files/v1/query/json' --header 'Content-Type: application/json' --data '{
                "rl": {
                    "query": {
                        "ip": "104.19.138.57",
                        "limit": 1000,
                        "response_format": "json",
                        "extended": true,
                        "classification": "KNOWN"
                    }
                }
            }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/ip/downloaded_files/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "ip": "104.19.138.57",
                  "response_format": "json",
                  "limit": 2
                }
              }
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        ip:
                          type: string
                        limit:
                          type: integer
                          description: The maximum number of results to return.
                          default: 1000
                        response_format:
                          type: string
                          description: Defines the response format.
                          enum:
                            - json
                            - xml
                          default: xml
                        classification:
                          type: string
                          description: File classification.
                          enum:
                            - KNOWN
                            - SUSPICIOUS
                            - MALICIOUS
                            - UNKNOWN
                        extended:
                          type: boolean
                          description: |-
                            If true, returns additional information:
                            - Additional sample properties: SHA1 hash, MD5 hash, SHA256 hash, sample size, sample type, download availability of the sample, first and last seen dates, first and last download times, last download URL.

                            - Sample reputation information: classification, threat level, trust factor, malware family name, malware type, threat name, targeted platform and subplatform.
                          default: false
                      required:
                        - ip
                  required:
                    - query
              required:
                - rl
  /api/networking/reputation/v1/query/{post_format}:
    post:
      summary: 'TCA-0407: Network Reputation API'
      operationId: post-api-networking-reputation-v1-query
      description: The Network Reputation service provides information regarding the  reputation of a requested URL, domain, or IP address. When a URL is submitted,  the service provides its ReversingLabs classification, along with an overview  of detections from our partners. It also includes the category of the URL  (for example phishing, gambling, adult content) and indicates whether we have  encountered any malware samples associated with the submitted URL.
      tags:
        - Network Threat Intelligence
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        network_locations:
                          type: array
                          maxItems: 100
                          items:
                            type: object
                            properties:
                              network_location:
                                type: string
                              type:
                                type: string
                                enum:
                                  - url
                                  - ip
                                  - domain
                            required:
                              - network_location
                        response_format:
                          type: string
                          enum:
                            - json
                            - xml
                          default: xml
                      required:
                        - network_locations
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/reputation/v1/query/json' --header 'Content-Type: application/json' --data '{
              "rl": {
                "query": {
                  "network_locations": [
                    {
                      "network_location": "https://microtechnology.hk/fidex/",
                      "type": "url"
                    },
                    {
                      "network_location": "92.123.37.9",
                      "type": "ip"
                    },
                    {
                      "network_location": "shamrocksuppliersummit.com",
                      "type": "domain"
                    },
                    {
                      "network_location": "http://microtechnology.hk/cgi-sys/suspendedpage.cgi"
                    },
                    {
                      "network_location": "https://google.com"
                    }
                  ],
                  "response_format": "json"
                }
              }
            }' --user <username>:<password>
        - lang: Python
          source: |-
            import requests
            import json

            url = "https://data.reversinglabs.com/api/networking/reputation/v1/query/json"

            json = {
              "rl": {
                "query": {
                  "network_locations": [
                    {
                      "network_location": "https://microtechnology.hk/fidex/",
                      "type": "url"
                    },
                    {
                      "network_location": "92.123.37.9",
                      "type": "ip"
                    },
                    {
                      "network_location": "shamrocksuppliersummit.com",
                      "type": "domain"
                    },
                    {
                      "network_location": "http://microtechnology.hk/cgi-sys/suspendedpage.cgi"
                    },
                    {
                      "network_location": "https://google.com"
                    }
                  ],
                  "response_format": "json"
                }
              }
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      entries:
                        type: array
                        maxItems: 100
                        items:
                          type: object
                          properties:
                            type:
                              type: string
                              description: URI type.
                              enum:
                                - url
                                - ip
                                - domain
                            requested_network_location:
                              type: string
                            first_seen:
                              type: string
                              format: date-time
                            last_seen:
                              type: string
                              format: date-time
                            classification:
                              type: string
                              enum:
                                - malicious
                                - suspicious
                                - known
                                - unknown
                              description: ReversingLabs classification.
                            reason:
                              type: string
                            threat_name:
                              type: string
                            third_party_reputations:
                              type: object
                              properties:
                                total:
                                  type: integer
                                undetected:
                                  type: integer
                                malicious:
                                  type: integer
                                clean:
                                  type: integer
                            categories:
                              type: array
                              items:
                                type: string
                            associated_malware:
                              type: boolean
              example:
                rl:
                  entries:
                    - type: domain
                      requested_network_location: example.com
                      associated_malware: false
                      last_seen: '2025-01-20T09:18:38'
                      first_seen: '2025-01-20T09:18:38'
                      third_party_reputations:
                        total: 13
                        undetected: 12
                        malicious: 1
                        suspicious: 0
                        clean: 0
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          description: Payload Too Large. The request contained more than the maximum allowed amount of network locations (100).
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/networking/user_override/v1/query/{post_format}:
    post:
      summary: 'TCA-0408: Network Reputation User Override'
      tags:
        - Network Threat Intelligence
      operationId: post-api-networking-user_override-v1-query
      description: The Network Reputation User Override service enables URL classification overrides and override removals. Any URL can be overridden to malicious, suspicious, or known, and any URL classification override can be removed. Users can make up to a total of 100 overrides and override removals in a single request. Overrides are visible to all users within the same organization. The service also supports listing existing overrides.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        user_override:
                          type: object
                          anyOf:
                            - properties:
                                override_network_locations:
                                  type: array
                                  maxItems: 100
                                  items:
                                    type: object
                                    properties:
                                      network_location:
                                        type: string
                                        format: url
                                        description: The overridden URL.
                                      type:
                                        type: string
                                        enum:
                                          - url
                                        description: Type of URI. Only `url` is supported.
                                      classification:
                                        type: string
                                        enum:
                                          - malicious
                                          - suspicious
                                          - known
                                          - unknown
                                        description: Assigned classification. Must conform to the ReversingLabs naming standard.
                                      TTL:
                                        type: string
                                        description: |
                                          Specifies the duration (in seconds) for which an override is valid. 
                                          It defines the lifespan of the override before it expires and needs to be reassessed or renewed. 
                                          In case the TTL is not set, there will be no expiration.
                                      threat_level:
                                        type: string
                                        description: |
                                          Malware severity indicator for suspicious and malicious URIs, expressed as an integer between 0 and 5, 
                                          where 5 indicates the most dangerous threats (highest severity).

                                          In case the value is not set, default values will be assigned based on the classification of the URI. 
                                          For known URIs, the allowed value is ``0``. If the value is not set, the default value is ``0``.

                                          For suspicious and malicious URIs, the allowed values are ``1``, ``2``, ``3``, ``4``, or ``5``. 
                                          If the value is not set, the default value is ``5``.

                                          For unknown URIs, setting the value is not allowed, and the value will default to ``None``.
                                      categories:
                                        type: array
                                        description: Contains arbitrary category names, for example `phishing`.
                                        items:
                                          type: string
                                    required:
                                      - network_location
                                      - type
                                      - classification
                            - properties:
                                remove_overrides:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      network_location:
                                        type: string
                                        description: URL for which the override should be removed.
                                        format: url
                                      type:
                                        description: URI type, always equal to `url`.
                                        type: string
                                        enum:
                                          - url
                    response_format:
                      type: string
                      enum:
                        - json
                        - xml
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      user_override:
                        type: object
                        anyOf:
                          - properties:
                              created_overrides:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    network_location:
                                      type: string
                                      format: url
                                      description: The overridden URL.
                                    type:
                                      type: string
                                      enum:
                                        - url
                                      description: Type of URI. Only `url` is supported.
                                    classification:
                                      type: string
                                      enum:
                                        - malicious
                                        - suspicious
                                        - known
                                        - unknown
                                      description: Assigned classification. Must conform to the ReversingLabs naming standard.
                                    TTL:
                                      type: string
                                      description: Specifies the duration (in seconds) for which an override is valid.  It defines the lifespan of the override before it expires and needs to be reassessed or renewed.  In case the TTL is not set, there will be no expiration.
                                    threat_level:
                                      type: string
                                      description: |
                                        Malware severity indicator for suspicious and malicious URIs, expressed as an integer between 0 and 5, 
                                        where 5 indicates the most dangerous threats (highest severity).

                                        In case the value is not set, default values will be assigned based on the classification of the URI. 
                                        For known URIs, the allowed value is ``0``. If the value is not set, the default value is ``0``.

                                        For suspicious and malicious URIs, the allowed values are ``1``, ``2``, ``3``, ``4``, or ``5``. 
                                        If the value is not set, the default value is ``5``.

                                        For unknown URIs, setting the value is not allowed, and the value will default to ``None``.
                                    categories:
                                      type: array
                                      description: Contains arbitrary category names, for example `phishing`.
                                      items:
                                        type: string
                                  required:
                                    - network_location
                                    - type
                                    - classification
                          - properties:
                              removed_overrides:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    network_location:
                                      type: string
                                      description: URL for which the override was removed.
                                      format: url
                                    type:
                                      description: URI type, always equal to `url`.
                                      type: string
                                      enum:
                                        - url
                          - properties:
                              invalid_network_locations:
                                type: array
                                description: Invalid URLs.
                                items:
                                  type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          description: Payload Too Large. The request contained more than the maximum allowed amount of network locations (100).
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |-
            curl --request POST --url 'https://data.reversinglabs.com/api/networking/user_override/v1/query/json' --header 'Content-Type: application/json' --user <username>:<password> --data '{
              "rl": {
                "query": {
                  "user_override": {
                    "override_network_locations": [
                      {
                        "network_location": "http://example.com",
                        "type": "url",
                        "classification": "malicious",
                        "categories": ["phishing"]
                      }
                    ],
                    "remove_overrides": [
                      {
                        "network_location": "http://location.com",
                        "type": "url"
                      }
                    ]
                  },
                "response_format": "json"
                }
              }
            }'
        - lang: Python
          source: |-
            import requests
            import json
            url = "https://data.reversinglabs.com/api/networking/user_override/v1/query/json"
            json = {
              "rl": {
                "query": {
                  "user_override": {
                    "override_network_locations": [
                      {
                        "network_location": "http://example.com",
                        "type": "url",
                        "classification": "malicious",
                        "categories": [
                          "phishing"
                        ]
                      }
                    ],
                    "remove_overrides": [
                      {
                        "network_location": "http://location.com",
                        "type": "url"
                      }
                    ]
                  },
                  "response_format": "json"
                }
              }
            }
            response = requests.post(url, json=json, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/RequestFormat'
  /api/networking/user_override/v1/query/list_overrides:
    get:
      summary: 'TCA-0408: List User Overrides'
      tags:
        - Network Threat Intelligence
      operationId: get-api-networking-user_override-v1-query-list_overrides
      description: The Network Reputation User Override service enables URL classification overrides. Any URL can be overridden to malicious, suspicious, or known. Overrides are visible to all users within the same organization. The service also supports  listing existing overrides.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      user_override:
                        type: object
                        properties:
                          network_locations:
                            type: array
                            items:
                              type: object
                              properties:
                                network_location:
                                  type: string
                                  format: url
                                type:
                                  type: string
                                  enum:
                                    - url
                                classification:
                                  type: string
                                threat_level:
                                  type: string
                                expiration_time:
                                  type: string
                          next_network_location:
                            type: string
                            format: sha1
              example:
                rl:
                  user_override:
                    next_network_location: 855259c27b4a0d4f4f94d75ae0d35c89c8635df8
                    network_locations:
                      - network_location: https://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings/
                        type: url
                        threat_level: 0
                        expiration_time: '2025-11-07T09:26:01'
                        classification: known
                      - network_location: http://schemas.openxmlformats.org/officeDocument/2006/relationships/pivotTable/
                        type: url
                        threat_level: 0
                        expiration_time: '2025-11-07T10:09:03'
                        classification: known
                      - network_location: https://schemas.openxmlformats.org/officeDocument/2006/relationships/ctrlProp/
                        type: url
                        threat_level: 0
                        expiration_time: '2025-11-07T10:08:55'
                        classification: known
                      - network_location: https://ns.adobe.com/xap/1.0/t/
                        type: url
                        threat_level: 0
                        expiration_time: '2025-11-09T05:58:06'
                        classification: known
                      - network_location: http://schemas.openxmlformats.org/drawingml/2006/chart:applyToSides,/
                        type: url
                        threat_level: 0
                        expiration_time: '2025-11-07T10:05:47'
                        classification: known
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: curl --url 'https://data.reversinglabs.com/api/networking/user_override/v1/query/list_overrides?format=json' --user <username>:<password>
        - lang: Python
          source: |-
            import requests

            url = "https://data.reversinglabs.com//api/networking/user_override/v1/query/list_overrides?format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - $ref: '#/components/parameters/ResponseFormat'
      - name: next_network_location
        in: query
        schema:
          type: string
          format: sha1
        description: Optional parameter used for pagination. To get the next page of results from the API, use the `next_network_location` value from the response in place of this parameter in a new request. When the parameter is not included in the request, only the first page of results is returned.
  /api/certificate/index/v1/query/thumbprint/{thumbprint}:
    get:
      summary: 'TCA-0501: Certificate Index'
      tags:
        - Certificate Threat Intelligence
      operationId: get-api-certificate-index-v1-query-thumbprint
      parameters:
        - $ref: '#/components/parameters/CertificateThumb'
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 100
            example: 50
          description: Optional parameter; specifies the maximum number of sample SHA1 hashes to include in the response. This value has to be an integer in the range from 1 and 100. When the parameter is not included in the request, 100 hashes are returned by default.
        - name: extended
          in: query
          schema:
            type: boolean
            default: false
            example: true
          description: 'If the extended option is selected, each SHA1 hash in the list will be expanded with additional metadata: certificate validation status, classification, threat level, trust factor, malware family name, threat name, malware type, targeted platform and subplatform; SHA1, MD5, PE_SHA1, PE_SHA256 and SHA256 hashes; sample size, sample type, download availability, first and last seen dates (UTC).'
        - $ref: '#/components/parameters/Classification'
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The Certificate Index API provides a list of samples that are signed with the requested certificate. The certificate should be requested using its thumbprint value as a SHA1, SHA256, or MD5 hash. Only one certificate thumbprint can be submitted in one request. Optional parameters can be used in the request to retrieve additional sample metadata and filter the results by classification status. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      request:
                        thumbprint: A909502DD82AE41433E6F83886B00D4277A32A7B
                        response_format: json
                        limit: 100
                        extended: false
                      samples: []
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      next_page:
                        type: string
                      request:
                        type: object
                        properties:
                          extended:
                            type: boolean
                          limit:
                            type: integer
                          response_format:
                            type: string
                          thumbprint:
                            type: string
                      samples:
                        type: array
                        items:
                          type: object
                          properties:
                            container_sha1:
                              type: string
                            sha1:
                              type: string
                            pe_sha1:
                              type: string
                            threat_level:
                              type: integer
                            classification:
                              type: string
                            threat_name:
                              type: string
                            sample_type:
                              type: string
                            validation:
                              type: array
                              items:
                                type: string
                            sample_size:
                              type: integer
                            sample_available:
                              type: boolean
                            platform:
                              type: string
                            last_seen:
                              type: string
                            malware_type:
                              type: string
                            first_seen:
                              type: string
                            sha256:
                              type: string
                            pe_sha256:
                              type: string
                            trust_factor:
                              type: integer
                            malware_family:
                              type: string
                            md5:
                              type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/certificate/index/v1/query/thumbprint/A909502DD82AE41433E6F83886B00D4277A32A7B?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/certificate/index/v1/query/thumbprint/A909502DD82AE41433E6F83886B00D4277A32A7B?format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
    parameters:
      - schema:
          type: string
        name: thumbprint
        in: path
        required: true
  /api/certificate/index/v1/query/thumbprint/{thumbprint}/page/{next_page}:
    get:
      summary: 'TCA-0501: Certificate Index (paginated)'
      tags:
        - Certificate Threat Intelligence
      operationId: get-api-certificate-index-v1-query-thumbprint-paginated
      parameters:
        - $ref: '#/components/parameters/CertificateThumb'
        - name: next_page
          in: path
          required: true
          schema:
            type: string
          description: Optional parameter used for pagination. To get the next page of results from the API, use the `next_page` value from the response with this parameter in a new request. When the parameter is not included in the request, only the first page of results is returned.
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 100
            example: 50
          description: Optional parameter; specifies the maximum number of sample SHA1 hashes to include in the response. This value has to be an integer in the range from 1 and 100. When the parameter is not included in the request, 100 hashes are returned by default.
        - name: extended
          in: query
          schema:
            type: boolean
            default: false
            example: true
          description: 'If the extended option is selected, each SHA1 hash in the list will be expanded with additional metadata: certificate validation status, classification, threat level, trust factor, malware family name, threat name, malware type, targeted platform and subplatform; SHA1, MD5, PE_SHA1, PE_SHA256 and SHA256 hashes; sample size, sample type, download availability, first and last seen dates (UTC).'
        - $ref: '#/components/parameters/Classification'
        - $ref: '#/components/parameters/ResponseFormat'
      description: The Certificate Index API provides a list of samples that are signed with the requested certificate. The certificate should be requested using its thumbprint value as a SHA1, SHA256, or MD5 hash. Only one certificate thumbprint can be submitted in one request. Optional parameters can be used in the request to retrieve additional sample metadata and filter the results by classification status.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      request:
                        thumbprint: A909502DD82AE41433E6F83886B00D4277A32A7B
                        response_format: json
                        limit: 100
                        extended: false
                        page: 0133a64a3e360138da5820e25178490577d0400d
                      samples: []
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      next_page:
                        type: string
                      request:
                        type: object
                        properties:
                          extended:
                            type: boolean
                          limit:
                            type: integer
                          response_format:
                            type: string
                          thumbprint:
                            type: string
                      samples:
                        type: array
                        items:
                          type: object
                          properties:
                            container_sha1:
                              type: string
                            sha1:
                              type: string
                            pe_sha1:
                              type: string
                            threat_level:
                              type: integer
                            classification:
                              type: string
                            threat_name:
                              type: string
                            sample_type:
                              type: string
                            validation:
                              type: array
                              items:
                                type: string
                            sample_size:
                              type: integer
                            sample_available:
                              type: boolean
                            platform:
                              type: string
                            last_seen:
                              type: string
                            malware_type:
                              type: string
                            first_seen:
                              type: string
                            sha256:
                              type: string
                            pe_sha256:
                              type: string
                            trust_factor:
                              type: integer
                            malware_family:
                              type: string
                            md5:
                              type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/certificate/index/v1/query/thumbprint/A909502DD82AE41433E6F83886B00D4277A32A7B?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests

            url = "https://data.reversinglabs.com/api/certificate/index/v1/query/thumbprint/A909502DD82AE41433E6F83886B00D4277A32A7B?format=json"

            headers = {
              'Accept': 'application/json',
            }

            response = requests.get(url, headers=headers, auth=('username', 'password'))

            print(response.text)
  /api/certificate/analytics/v1/query/thumbprint/{thumbprint}/{post_format}:
    get:
      summary: 'TCA-0502: Certificate Analytics'
      tags:
        - Certificate Threat Intelligence
      operationId: get-api-certificate-analytics-v1-query-thumbprint
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - $ref: '#/components/parameters/CertificateThumb'
      description: The Certificate Analytics API provides certificate analytics for the requested certificate and its chain of trust. The certificate should be requested using its thumbprint value as a SHA1, SHA256, or MD5 hash. Sending requests using the GET method allows only one thumbprint per request, while the POST method accepts up to 100 thumbprints in one request. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      request:
                        type: object
                        properties:
                          response_format:
                            type: string
                          thumbprint:
                            type: string
                      certificate_analytics:
                        type: object
                        properties:
                          certificate_first_seen:
                            type: string
                          statistics:
                            type: object
                            properties:
                              known:
                                type: integer
                              unknown:
                                type: integer
                              malicious:
                                type: integer
                              suspicious:
                                type: integer
                              total:
                                type: integer
                          classification:
                            type: object
                            properties:
                              status:
                                type: string
                          certificate:
                            type: object
                            properties:
                              valid_from:
                                type: string
                              signature_algorithm:
                                type: string
                              valid_to:
                                type: string
                              version:
                                type: string
                              extensions:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    is_critical:
                                      type: string
                                    name:
                                      type: string
                                    value:
                                      type: string
                              signature:
                                type: string
                              common_name:
                                type: string
                              serial_number:
                                type: string
                              certificate_thumbprints:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    name:
                                      type: string
                                    value:
                                      type: string
                              issuer:
                                type: string
              examples:
                example:
                  value:
                    rl:
                      request:
                        thumbprint: 18254B1DC375B74E339EB99ABFE31AF0D735CB5A3B535570731175811D735B0D
                        response_format: json
                      certificate_analytics:
                        certificate:
                          common_name: Microsoft
                          valid_from: Sep  3 17:25:37 2018 GMT
                          valid_to: Oct  3 17:25:37 2018 GMT
                          signature_algorithm: sha1WithRSAEncryption
                          signature: CB1D7E0B933642F8B9CA16C90825B6FE7C449932DFBB2B6651077E73583394B37551B2AA2880C7B0F4C2E7289D0743996ACB34CB8FE71D0438072F921F3E7A53E547970B4BC8928D2F18ED9FCCA8062D46A6EBFE24166523DF9191AF84F8FCD3450D82E0556031E7580494597661EB155DA13D744F0BADCD14510FF29C18499BDB3239926A0281FB0090EF548D2AB7DC68A952CFAC1B48ED459E777EA9136DAAA33ACB5149748146DC7138FE7E8F06978B12F8B2B0F47CA24E927EB6A3A8A26A6A85AD046F1D8897F3843A072E3695BAAA4AC39797D66C7A6C1E50F1F6B3B1D9131288343BF44436A071B36B5137F206025550755F16D7E79D02709ACF3235FD
                          extensions:
                            - name: X509v3 Key Usage
                              value: Digital Signature, Non Repudiation
                              is_critical: 'True'
                            - name: X509v3 Basic Constraints
                              value: CA:FALSE
                              is_critical: 'True'
                            - name: Authority Information Access
                              value: |
                                OCSP - URI:http://ocsp.globaltrustfinder.com
                              is_critical: 'False'
                            - name: X509v3 Certificate Policies
                              value: |
                                Policy: 1.3.6.1.4.1.15945.1.1.1
                                  User Notice:
                                    Explicit Text: Warning: Certificates are issued under this policy to individuals that have not had their identity confirmed. Do not use these certificates for valuable transactions. NO LIABILITY IS ACCEPTED.
                              is_critical: 'False'
                            - name: X509v3 CRL Distribution Points
                              value: |

                                Full Name:
                                  URI:http://www.globaltrustfinder.com/crls/AscertiaPublicCA1.crl
                              is_critical: 'False'
                            - name: X509v3 Extended Key Usage
                              value: Code Signing
                              is_critical: 'False'
                          certificate_thumbprints:
                            - name: MD5
                              value: 2377666edb5a4d5656f68e002efb8415
                            - name: SHA1
                              value: 4f0333347b6f953b33966e976f24c5da36d75143
                            - name: SHA256
                              value: 18254B1DC375B74E339EB99ABFE31AF0D735CB5A3B535570731175811D735B0D
                          serial_number: 9935F30E9D6FECB0873E4114E000E1C776B3D432
                          version: '2'
                          issuer:
                            common_name: Ascertia Public CA 1
                            valid_from: Apr 21 12:15:17 2009 GMT
                            valid_to: Apr 14 23:59:59 2028 GMT
                            signature_algorithm: sha1WithRSAEncryption
                            signature: 949497A1A31399BA864A5C8B658B3E824CAC6F744C02DB8A01994B5CD360BB08C14C5FC7456776147F614EDD5107F9BC53E1CD07FD9B09BDBE2753F56C1DE968348660E24FC2E1E72ED3E17CAA8EE30A377729EDE0C592B482521BD3F0B8369FFAB179E24C0F7821B45868C97B48E40FFA0A63C706470D32D4190213912A3A49E35C126BEBC7EAFD53CC2F28B70FB1BB18320243BF8519A6981220183BB0C4A7CBADD05045959E051996A87EE0AD0944D20618A41152E05968AF006A8E2203A7A147E763AB2D2F602D5D9FD5E9B1310025C21DCB3019B0BD4B5342CFBEF0CF285F61295D90881DEA0E10510C6F3984BF823CF32A281C9C5C4CBD36EAF725FF52
                            extensions:
                              - name: X509v3 Key Usage
                                value: Certificate Sign, CRL Sign
                                is_critical: 'True'
                              - name: X509v3 Basic Constraints
                                value: CA:TRUE, pathlen:2
                                is_critical: 'True'
                              - name: X509v3 Certificate Policies
                                value: |
                                  Policy: 1.3.6.1.4.1.15945.1.1.1
                                    User Notice:
                                      Explicit Text: Warning: Certificates are issued under this policy to individuals that have not had their identity confirmed. Do not use these certificates for valuable transactions. NO LIABILITY IS ACCEPTED.
                                is_critical: 'False'
                              - name: X509v3 CRL Distribution Points
                                value: |

                                  Full Name:
                                    URI:http://www.ascertia.com/OnlineCA/crls/AscertiaRootCA2/AscertiaRootCA2.crl
                                is_critical: 'False'
                              - name: Authority Information Access
                                value: |
                                  OCSP - URI:http://ocsp.globaltrustfinder.com
                                is_critical: 'False'
                            certificate_thumbprints:
                              - name: MD5
                                value: c00947372e2954d2202b82c0b435810e
                              - name: SHA1
                                value: 36d8f9de10381aaee9bca2aebca8b75804f49ea7
                              - name: SHA256
                                value: 74FBDED7D182E0C8BD89EE7F277EC99A18688265B28918D24E8787CFE9E70599
                            serial_number: E6
                            version: '2'
                            issuer: Ascertia Root CA 2
                        statistics:
                          unknown: 0
                          known: 1
                          malicious: 0
                          suspicious: 0
                          total: 1
                        classification:
                          status: undefined
                        certificate_first_seen: '2018-11-25T23:50:11'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/certificate/analytics/v1/query/thumbprint/18254B1DC375B74E339EB99ABFE31AF0D735CB5A3B535570731175811D735B0D?format=json' --user <username>:<password> --header 'Content-Type: application/json'
        - lang: Python
          source: |
            import requests
            import json
            url = "https://data.reversinglabs.com/api/certificate/analytics/v1/query/thumbprint/18254B1DC375B74E339EB99ABFE31AF0D735CB5A3B535570731175811D735B0D?format=json"
            json = {
              "rl": {
                "query": {
                  "url": "reversinglabs.com",
                  "response_format": "json"
                }
              }
            }
            response = requests.get(url, auth=('username', 'password'), json=json)
            print(response.text)
    post:
      summary: 'TCA-0502: Certificate Analytics'
      tags:
        - Certificate Threat Intelligence
      operationId: post-api-certificate-analytics-v1-query-thumbprint
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: The Certificate Analytics API provides certificate analytics for the requested certificate and its chain of trust. The certificate should be requested using its thumbprint value as a SHA1, SHA256, or MD5 hash. Sending requests using the GET method allows only one thumbprint per request, while the POST method accepts up to 100 thumbprints in one request. Find more information in [the official API documentation](https://docs.reversinglabs.com/SpectraIntelligence/).
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      request:
                        thumbprints:
                          - 18254B1DC375B74E339EB99ABFE31AF0D735CB5A3B535570731175811D735B0D
                        response_format: json
                      certificate_analytics:
                        - certificate:
                            common_name: Microsoft
                            valid_from: Sep  3 17:25:37 2018 GMT
                            valid_to: Oct  3 17:25:37 2018 GMT
                            signature_algorithm: sha1WithRSAEncryption
                            signature: CB1D7E0B933642F8B9CA16C90825B6FE7C449932DFBB2B6651077E73583394B37551B2AA2880C7B0F4C2E7289D0743996ACB34CB8FE71D0438072F921F3E7A53E547970B4BC8928D2F18ED9FCCA8062D46A6EBFE24166523DF9191AF84F8FCD3450D82E0556031E7580494597661EB155DA13D744F0BADCD14510FF29C18499BDB3239926A0281FB0090EF548D2AB7DC68A952CFAC1B48ED459E777EA9136DAAA33ACB5149748146DC7138FE7E8F06978B12F8B2B0F47CA24E927EB6A3A8A26A6A85AD046F1D8897F3843A072E3695BAAA4AC39797D66C7A6C1E50F1F6B3B1D9131288343BF44436A071B36B5137F206025550755F16D7E79D02709ACF3235FD
                            extensions:
                              - name: X509v3 Key Usage
                                value: Digital Signature, Non Repudiation
                                is_critical: 'True'
                              - name: X509v3 Basic Constraints
                                value: CA:FALSE
                                is_critical: 'True'
                              - name: Authority Information Access
                                value: |
                                  OCSP - URI:http://ocsp.globaltrustfinder.com
                                is_critical: 'False'
                              - name: X509v3 Certificate Policies
                                value: |
                                  Policy: 1.3.6.1.4.1.15945.1.1.1
                                    User Notice:
                                      Explicit Text: Warning: Certificates are issued under this policy to individuals that have not had their identity confirmed. Do not use these certificates for valuable transactions. NO LIABILITY IS ACCEPTED.
                                is_critical: 'False'
                              - name: X509v3 CRL Distribution Points
                                value: |

                                  Full Name:
                                    URI:http://www.globaltrustfinder.com/crls/AscertiaPublicCA1.crl
                                is_critical: 'False'
                              - name: X509v3 Extended Key Usage
                                value: Code Signing
                                is_critical: 'False'
                            certificate_thumbprints:
                              - name: MD5
                                value: 2377666edb5a4d5656f68e002efb8415
                              - name: SHA1
                                value: 4f0333347b6f953b33966e976f24c5da36d75143
                              - name: SHA256
                                value: 18254B1DC375B74E339EB99ABFE31AF0D735CB5A3B535570731175811D735B0D
                            serial_number: 9935F30E9D6FECB0873E4114E000E1C776B3D432
                            version: '2'
                            issuer:
                              common_name: Ascertia Public CA 1
                              valid_from: Apr 21 12:15:17 2009 GMT
                              valid_to: Apr 14 23:59:59 2028 GMT
                              signature_algorithm: sha1WithRSAEncryption
                              signature: 949497A1A31399BA864A5C8B658B3E824CAC6F744C02DB8A01994B5CD360BB08C14C5FC7456776147F614EDD5107F9BC53E1CD07FD9B09BDBE2753F56C1DE968348660E24FC2E1E72ED3E17CAA8EE30A377729EDE0C592B482521BD3F0B8369FFAB179E24C0F7821B45868C97B48E40FFA0A63C706470D32D4190213912A3A49E35C126BEBC7EAFD53CC2F28B70FB1BB18320243BF8519A6981220183BB0C4A7CBADD05045959E051996A87EE0AD0944D20618A41152E05968AF006A8E2203A7A147E763AB2D2F602D5D9FD5E9B1310025C21DCB3019B0BD4B5342CFBEF0CF285F61295D90881DEA0E10510C6F3984BF823CF32A281C9C5C4CBD36EAF725FF52
                              extensions:
                                - name: X509v3 Key Usage
                                  value: Certificate Sign, CRL Sign
                                  is_critical: 'True'
                                - name: X509v3 Basic Constraints
                                  value: CA:TRUE, pathlen:2
                                  is_critical: 'True'
                                - name: X509v3 Certificate Policies
                                  value: |
                                    Policy: 1.3.6.1.4.1.15945.1.1.1
                                      User Notice:
                                        Explicit Text: Warning: Certificates are issued under this policy to individuals that have not had their identity confirmed. Do not use these certificates for valuable transactions. NO LIABILITY IS ACCEPTED.
                                  is_critical: 'False'
                                - name: X509v3 CRL Distribution Points
                                  value: |

                                    Full Name:
                                      URI:http://www.ascertia.com/OnlineCA/crls/AscertiaRootCA2/AscertiaRootCA2.crl
                                  is_critical: 'False'
                                - name: Authority Information Access
                                  value: |
                                    OCSP - URI:http://ocsp.globaltrustfinder.com
                                  is_critical: 'False'
                              certificate_thumbprints:
                                - name: MD5
                                  value: c00947372e2954d2202b82c0b435810e
                                - name: SHA1
                                  value: 36d8f9de10381aaee9bca2aebca8b75804f49ea7
                                - name: SHA256
                                  value: 74FBDED7D182E0C8BD89EE7F277EC99A18688265B28918D24E8787CFE9E70599
                              serial_number: E6
                              version: '2'
                              issuer: Ascertia Root CA 2
                          statistics:
                            unknown: 0
                            known: 1
                            malicious: 0
                            suspicious: 0
                            total: 1
                          classification:
                            status: undefined
                          certificate_first_seen: '2018-11-25T23:50:11'
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      request:
                        type: object
                        properties:
                          response_format:
                            type: string
                          thumbprints:
                            type: array
                            items:
                              required: []
                              properties: {}
                        required:
                          - response_format
                          - thumbprints
                      certificate_analytics:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - certificate_first_seen
                          properties:
                            certificate_first_seen:
                              type: string
                            statistics:
                              type: object
                              properties:
                                known:
                                  type: number
                                unknown:
                                  type: number
                                malicious:
                                  type: number
                                suspicious:
                                  type: number
                                total:
                                  type: number
                              required:
                                - known
                                - unknown
                                - malicious
                                - suspicious
                                - total
                            classification:
                              type: object
                              properties:
                                status:
                                  type: string
                              required:
                                - status
                            certificate:
                              type: object
                              properties:
                                valid_from:
                                  type: string
                                signature_algorithm:
                                  type: string
                                valid_to:
                                  type: string
                                usage:
                                  type: array
                                  items:
                                    required: []
                                    properties: {}
                                version:
                                  type: string
                                signature:
                                  type: string
                                common_name:
                                  type: string
                                serial_number:
                                  type: string
                                certificate_thumbprints:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - name
                                      - value
                                    properties:
                                      name:
                                        type: string
                                      value:
                                        type: string
                                issuer:
                                  type: object
                                  properties:
                                    valid_from:
                                      type: string
                                    signature_algorithm:
                                      type: string
                                    valid_to:
                                      type: string
                                    usage:
                                      type: array
                                      items:
                                        required: []
                                        properties: {}
                                    version:
                                      type: string
                                    signature:
                                      type: string
                                    common_name:
                                      type: string
                                    serial_number:
                                      type: string
                                    certificate_thumbprints:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required:
                                          - name
                                          - value
                                        properties:
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    issuer:
                                      type: string
                                  required:
                                    - valid_from
                                    - signature_algorithm
                                    - valid_to
                                    - usage
                                    - version
                                    - signature
                                    - common_name
                                    - serial_number
                                    - certificate_thumbprints
                                    - issuer
                              required:
                                - valid_from
                                - signature_algorithm
                                - valid_to
                                - usage
                                - version
                                - signature
                                - common_name
                                - serial_number
                                - certificate_thumbprints
                                - issuer
                    required:
                      - request
                      - certificate_analytics
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/certificate/analytics/v1/query/thumbprint/json' --user <username>:<password> --header 'Content-Type: application/json' --data '{
              "rl": {
                "query": {
                  "thumbprints": [
                    "18254B1DC375B74E339EB99ABFE31AF0D735CB5A3B535570731175811D735B0D"
                    ],
                  "format": "json"
                }
              }
            }'
        - lang: Python
          source: |
            import requests
            import json
            url = "https://data.reversinglabs.com/api/certificate/analytics/v1/query/thumbprint/json"
            json = {
              "rl": {
                "query": {
                  "thumbprints": [
                    "18254B1DC375B74E339EB99ABFE31AF0D735CB5A3B535570731175811D735B0D"
                  ],
                  "format": "json"
                }
              }
            }
            response = requests.post(url, auth=('username', 'password'), json=json)
            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              description: ''
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        thumbprints:
                          type: array
                          items:
                            required: []
                            properties: {}
                        format:
                          type: string
                      required:
                        - thumbprints
                        - format
                  required:
                    - query
              required:
                - rl
        description: '`thumbprints` is a required parameter that specifies a list of certificate thumbprints for which the user is requesting data from the service. Each thumbprint value should be provided as a valid hash. Supported hash types are: **MD5, SHA1, SHA256**. Up to 100 thumbprints can be submitted in one request.'
    parameters:
      - schema:
          type: string
        name: post_format
        in: path
        required: true
      - schema:
          type: string
        name: thumbprint
        in: path
        required: true
  /api/certificate/search/v1/query/subject/{post_format}:
    post:
      summary: 'TCA-0503: Certificate Thumbprint Search'
      tags:
        - Certificate Threat Intelligence
      operationId: post-api-certificate-search-v1-query-subject
      parameters:
        - $ref: '#/components/parameters/RequestFormat'
      description: 'The Certificate Thumbprint Search API allows users to find certificate thumbprints by using the full or partial certificate common name as the search keyword. The results contain thumbprints of certificates that match the requested common name. Those thumbprints can be used with the TCA-0501 and TCA-0502 APIs to obtain a list of certificate-signed samples and certificate analytics, respectively. '
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      request:
                        common_name: Microsoft*
                        limit: 5
                        response_format: json
                      search:
                        - common_name: Microsoft
                          thumbprints:
                            - certificate_thumbprints:
                                - name: MD5
                                  value: 2377666edb5a4d5656f68e002efb8415
                                - name: SHA1
                                  value: 4f0333347b6f953b33966e976f24c5da36d75143
                                - name: SHA256
                                  value: 18254B1DC375B74E339EB99ABFE31AF0D735CB5A3B535570731175811D735B0D
                            - certificate_thumbprints:
                                - name: MD5
                                  value: 91888389aa2cac07c610f469e5f18092
                                - name: SHA1
                                  value: e8a53bed75c33d48cf49382ddba6b048e85072b2
                                - name: SHA256
                                  value: 0AF958372FEDCFA29B8DD4C6DB83D44DC25AC6AD2435ACA5C0B08DCD5D596828
                            - certificate_thumbprints:
                                - name: MD5
                                  value: f971881e5219b17d98c181d50440d3d0
                                - name: SHA1
                                  value: b5d1c90c8e8036610094bb6182d6c3f7481cd9eb
                                - name: SHA256
                                  value: 0F59B2A0809BE2B87728DCE7051C81FFD005A00CEA60FF1F0D7E11C911C8BBAB
                            - certificate_thumbprints:
                                - name: MD5
                                  value: 2acdfc999c7b50813635718cfb0eea7f
                                - name: SHA1
                                  value: 39c4da3d122c4bc9369928464377ead34878d4a6
                                - name: SHA256
                                  value: 2606995A71C2128D6410DE8F1D7C199C5254F677FA44EA312C32A8B991F32C5F
                            - certificate_thumbprints:
                                - name: MD5
                                  value: e0379a7291368975ffa2c8c10cb71fe7
                                - name: SHA1
                                  value: c8f9dd2174879e6d50def833c68338fe4227c26f
                                - name: SHA256
                                  value: 0695208909EDBFD9AEBAAF712EEE1FC7916BC0F563475CDEE5E64F497D7563D0
                      next_page_common_name: Microsoft
                      next_page_thumbprint: 2606995A71C2128D6410DE8F1D7C199C5254F677FA44EA312C32A8B991F32C5F
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      next_page_common_name:
                        type: string
                      search:
                        type: array
                        items:
                          type: object
                          properties:
                            common_name:
                              type: string
                            thumbprints:
                              type: array
                              items:
                                type: object
                                properties:
                                  certificate_thumbprints:
                                    type: array
                                    items:
                                      type: object
                                      properties:
                                        name:
                                          type: string
                                        value:
                                          type: string
                      next_page_thumbprint:
                        type: string
                      request:
                        type: object
                        properties:
                          common_name:
                            type: string
                          limit:
                            type: integer
                          response_format:
                            type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/certificate/search/v1/query/subject/json' --header 'Content-Type: application/json: ' --data '{
                "rl":
                   {
                      "query":
                         {
                            "common_name":"*i*",
                            "limit":"3",
                            "response_format":"json"
                         }
                   }
             }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/certificate/search/v1/query/subject/json"

            json = {
              "rl": {
                "query": {
                  "common_name": "Microsoft*",
                  "response_format": "json",
                  "limit": 5
                }
              }
            }

            headers = {
              'Accept': 'application/json',
            }

            response = requests.post(url, headers=headers, json=json, auth=('username', 'password'))

            print(response.text)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    query:
                      type: object
                      properties:
                        common_name:
                          type: string
                          description: '`common_name` is a required parameter that supports partial matching with * as the wildcard character. `limit` is an optional parameter that specifies the maximum number of thumbprints to return in the response (1-100, with 100 as the default).'
                        limit:
                          type: integer
                          minimum: 1
                          maximum: 100
                          default: 100
                          description: Maximum number of certificate thumbprints to be returned.
                        page_common_name:
                          type: string
                          description: An optional pagination parameter for retrieving the next page of the results. Pagination value for the next page is provided in the previous request response as `next_page_common_name`.
                        page_thumbprint:
                          type: string
                          description: An optional pagination parameter for retrieving the next page of the results. Pagination value for the next page is provided in the previous request response as `next_page_thumbprint`.
                        response_format:
                          type: string
                          enum:
                            - xml
                            - json
                          default: xml
                          description: '`response_format` is an optional parameter that allows choosing the response format (XML or JSON; XML is the default).'
                      required:
                        - common_name
        description: ''
  /api/customer_usage/v1/usage/{type}:
    get:
      summary: 'TCA-9999: Customer Usage Single User Query'
      tags:
        - Customer Administration & Usage
      operationId: get-api-customer_usage-v1-usage
      parameters:
        - name: date
          in: query
          schema:
            type: string
            format: date
            example:
              - '2020-04-28'
          description: '**Supported only when /daily is used in the endpoint path.** Optional parameter that specifies the date for which customer usage information should be returned. Users can submit one value per request in the `YYYY-MM-DD` format. This parameter is incompatible and mutually exclusive with `from&to`.'
        - name: month
          in: query
          schema:
            type: string
            example:
              - 2020-04
          description: '**Supported only when /monthly is used in the endpoint path.** Optional parameter that specifies the month for which customer usage information should be returned. Users can submit one value per request in the `YYYY-MM` format. This parameter is incompatible and mutually exclusive with `from&to`.'
        - name: from
          in: query
          schema:
            type: string
            format: date
            example: '2020-01-17'
          description: Optional parameter that specifies the start date for the customer usage report. Must be used together with `to`.  When used with /daily, the value should be in the `YYYY-MM-DD` format. When used with /monthly, the value should be in the `YYYY-MM` format. This parameter is incompatible and mutually exclusive with `month` and `date` parameters.
        - name: to
          in: query
          schema:
            type: string
            format: date
            example: '2020-06-03'
          description: Optional parameter that specifies the end date for the customer usage report. Must be used together with `from`. When used with /daily, the value should be in the `YYYY-MM-DD` format. When used with /monthly, the value should be in the `YYYY-MM` format. This parameter is incompatible and mutually exclusive with `month` and `date` parameters.
        - $ref: '#/components/parameters/ResponseFormat'
        - name: user
          in: query
          required: false
          description: Return usage for the specified user (must belong to the same company as the authenticated user). Supported for `type=daily` and `type=monthly` only. Not supported for `type=date_range` or `type=yara`. If not specified, the usage for the current user is returned.
          schema:
            type: string
            example: u/company/user
        - name: user
          in: query
          required: false
          description: Return usage/limits for the specified user. The user must belong to the same company as the authenticated user. If not specified, the usage/limits for the current user are returned.
          schema:
            type: string
            example: u/company/user
      description: 'The Customer Usage Single User API allows ReversingLabs customers to track their usage of Spectra Intelligence services provisioned to their account. It returns the number of queries made in the requested date range for the current user account (the one that is sending the request). Some products may specify usage quotas in bytes instead of requests. In that case the number of used bytes is returned alongside the number of requests. Provisioned services with no registered usage in the requested date range are not included in the response. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      usage_reports:
                        - date: '2025-01-09'
                          usage_report:
                            - product: TCA-0403 URL Threat Intelligence
                              number_of_queries: 2
                            - product: TCA-0405 Domain Threat Intelligence
                              number_of_queries: 14
                            - product: TCA-9999
                              number_of_queries: 3
                            - product: TCF-0601 Certificate Feed
                              number_of_queries: 1
                        - date: '2025-01-10'
                          usage_report:
                            - product: TCF-0502 Whitelisted Files - Changes
                              number_of_queries: 4
                            - product: TCF-0601 Certificate Feed
                              number_of_queries: 1
                        - date: '2025-01-13'
                          usage_report:
                            - product: TCA-0101 File Reputation
                              number_of_queries: 6
                            - product: TCA-0102 File Reputation User Override
                              number_of_queries: 3
                        - date: '2025-01-15'
                          usage_report:
                            - product: TCA-0101 File Reputation
                              number_of_queries: 5
                            - product: TCA-0102 File Reputation User Override
                              number_of_queries: 3
                            - product: TCA-0103 Historic Multi-AV Scan Records
                              number_of_queries: 4
                            - product: TCA-0104 File Analysis - Hash
                              number_of_queries: 5
                            - product: TCA-0105 File Analysis - Non-Malicious
                              number_of_queries: 5
                            - product: TCA-0201 File Download
                              number_of_queries: 3
                            - product: TCA-0202/TCA-0203 (Meta Upload)
                              number_of_queries: 1
                            - product: TCA-0202/TCA-0203 (Sample Upload)
                              number_of_queries: 1
                            - product: TCA-0204 Delete File
                              number_of_queries: 3
                        - date: '2025-01-16'
                          usage_report:
                            - product: TCA-0319 YARA Retroactive Hunting
                              number_of_queries: 2
                            - product: TCA-0319 (Matches Feed)
                              number_of_queries: 1
                            - product: TCA-0320 Advanced Search
                              number_of_queries: 1
                            - product: TCA-0321 RHA1 Analytics
                              number_of_queries: 1
                            - product: TCA-0408 Network Reputation User Override API
                              number_of_queries: 2
                        - date: '2025-01-17'
                          usage_report:
                            - product: TCA-0302 ImpHash Similarity
                              number_of_queries: 1
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      date:
                        type: string
                        format: date
                      month:
                        type: string
                      usage_report:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          type: object
                          required:
                            - product
                            - number_of_queries
                          properties:
                            product:
                              type: string
                            number_of_queries:
                              type: integer
                            used_bytes:
                              type: integer
                      usage_reports:
                        type: array
                        uniqueItems: true
                        items:
                          properties:
                            date:
                              type: string
                              format: date
                            month:
                              type: string
                            usage_report:
                              type: array
                              uniqueItems: true
                              minItems: 1
                              items:
                                type: object
                                required:
                                  - product
                                  - number_of_queries
                                  - allocation
                                properties:
                                  product:
                                    type: string
                                  number_of_queries:
                                    type: integer
                                  used_bytes:
                                    type: integer
                                  allocation:
                                    type: array
                                    items:
                                      type: object
                                      required:
                                        - name
                                        - number_of_queries
                                        - used_bytes
                                      properties:
                                        name:
                                          type: string
                                        number_of_queries:
                                          type: integer
                                        used_bytes:
                                          type: integer
                            start_date:
                              type: string
                              format: date
                            end_date:
                              type: string
                              format: date
                            count:
                              type: integer
                            used_bytes:
                              type: integer
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/customer_usage/v1/usage/daily?from=2020-01-17&to=2020-06-03&format=json' --user <username>:<password>
        - lang: Python
          label: Python for specific month
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/customer_usage/v1/usage/monthly?month=2019-10&format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - schema:
          type: string
          enum:
            - daily
            - date_range
            - monthly
            - yara
          example: daily
        name: type
        in: path
        required: true
        description: Selects the type of query to run. `daily` and `monthly` show usage in the selected time period. `date_range` shows usage for accounts with product licences that have a fixed expiration date, and doesn't accept additional date specifying parameters. `yara` returns information about the number of active YARA rulesets.
  /api/customer_usage/v1/usage/company/{type}:
    get:
      summary: 'TCA-9999: Customer Usage Company Query'
      tags:
        - Customer Administration & Usage
      operationId: get-api-customer_usage-v1-usage-company
      parameters:
        - name: date
          in: query
          schema:
            type: string
            format: date
            example:
              - '2020-04-28'
          description: '**Supported only when /daily is used in the endpoint path.** Optional parameter that specifies the date for which customer usage information should be returned. Users can submit one value per request in the `YYYY-MM-DD` format. This parameter is incompatible and mutually exclusive with `from&to`.'
        - name: month
          in: query
          schema:
            type: string
            example:
              - 2020-04
          description: '**Supported only when /monthly is used in the endpoint path.** Optional parameter that specifies the month for which customer usage information should be returned. Users can submit one value per request in the `YYYY-MM` format. This parameter is incompatible and mutually exclusive with `from&to`.'
        - name: from
          in: query
          schema:
            type: string
            format: date
            example: '2020-01-17'
          description: Optional parameter that specifies the start date for the customer usage report. Must be used together with `to`.  When used with /daily, the value should be in the `YYYY-MM-DD` format. When used with /monthly, the value should be in the `YYYY-MM` format. This parameter is incompatible and mutually exclusive with `month` and `date` parameters.
        - name: to
          in: query
          schema:
            type: string
            format: date
            example: '2020-01-17'
          description: Optional parameter that specifies the end date for the customer usage report. Must be used together with `from`. When used with /daily, the value should be in the `YYYY-MM-DD` format. When used with /monthly, the value should be in the `YYYY-MM` format. This parameter is incompatible and mutually exclusive with `month` and `date` parameters.
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'The Customer Usage Company API allows ReversingLabs customers to track the usage of Spectra Intelligence services provisioned to all accounts in a company. It returns the combined usage for all accounts within the company the current user belongs to. Provisioned services with no registered usage in the requested date range are not included in the response. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      usage_reports:
                        - date: '2025-01-09'
                          usage_report:
                            - product: TCA-0403 URL Threat Intelligence
                              number_of_queries: 2
                            - product: TCA-0405 Domain Threat Intelligence
                              number_of_queries: 14
                            - product: TCA-9999
                              number_of_queries: 3
                            - product: TCF-0601 Certificate Feed
                              number_of_queries: 1
                        - date: '2025-01-10'
                          usage_report:
                            - product: TCF-0502 Whitelisted Files - Changes
                              number_of_queries: 4
                            - product: TCF-0601 Certificate Feed
                              number_of_queries: 1
                        - date: '2025-01-13'
                          usage_report:
                            - product: TCA-0101 File Reputation
                              number_of_queries: 6
                            - product: TCA-0102 File Reputation User Override
                              number_of_queries: 3
                        - date: '2025-01-15'
                          usage_report:
                            - product: TCA-0101 File Reputation
                              number_of_queries: 5
                            - product: TCA-0102 File Reputation User Override
                              number_of_queries: 3
                            - product: TCA-0103 Historic Multi-AV Scan Records
                              number_of_queries: 4
                            - product: TCA-0104 File Analysis - Hash
                              number_of_queries: 5
                        - date: '2025-01-16'
                          usage_report:
                            - product: TCA-0319 YARA Retroactive Hunting
                              number_of_queries: 2
                            - product: TCA-0319 (Matches Feed)
                              number_of_queries: 1
                            - product: TCA-0320 Advanced Search
                              number_of_queries: 1
                            - product: TCA-0321 RHA1 Analytics
                              number_of_queries: 1
                            - product: TCA-0408 Network Reputation User Override API
                              number_of_queries: 2
                        - date: '2025-01-17'
                          usage_report:
                            - product: TCA-0302 ImpHash Similarity
                              number_of_queries: 1
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      date:
                        type: string
                        format: date
                      month:
                        type: string
                      usage_report:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          type: object
                          required:
                            - product
                            - number_of_queries
                          properties:
                            product:
                              type: string
                            number_of_queries:
                              type: integer
                            used_bytes:
                              type: integer
                      usage_reports:
                        type: array
                        uniqueItems: true
                        items:
                          properties:
                            date:
                              type: string
                              format: date
                            month:
                              type: string
                            usage_report:
                              type: array
                              uniqueItems: true
                              minItems: 1
                              items:
                                type: object
                                required:
                                  - product
                                  - number_of_queries
                                  - allocation
                                properties:
                                  product:
                                    type: string
                                  number_of_queries:
                                    type: integer
                                  used_bytes:
                                    type: integer
                                  allocation:
                                    type: array
                                    items:
                                      type: object
                                      required:
                                        - name
                                        - number_of_queries
                                        - used_bytes
                                      properties:
                                        name:
                                          type: string
                                        number_of_queries:
                                          type: integer
                                        used_bytes:
                                          type: integer
                            start_date:
                              type: string
                              format: date
                            end_date:
                              type: string
                              format: date
                            count:
                              type: integer
                            used_bytes:
                              type: integer
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/customer_usage/v1/usage/company/daily?from=2020-01-17&to=2020-06-03&format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/customer_usage/v1/usage/company/monthly?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - schema:
          type: string
          enum:
            - daily
            - monthly
            - date_range
          example: daily
        name: type
        in: path
        required: true
        description: Selects the type of query to run. `daily` and `monthly` show usage in the selected time period. `date_range` shows usage for accounts with product licences that have a fixed expiration date and doesn't accept additional date specifying parameters.
  /api/customer_usage/v1/limits:
    get:
      summary: 'TCA-9999: Quota Limits (single user)'
      tags:
        - Customer Administration & Usage
      operationId: get-api-customer_usage-v1-limits
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - name: user
          in: query
          required: false
          description: Return usage/limits for the specified user. The user must belong to the same company as the authenticated user. If not specified, the usage/limits for the current user are returned.
          schema:
            type: string
            example: u/company/user
      description: 'This query returns current quota limits for APIs accessible to the authenticated user or users belonging to the authenticated user''s company. Products are grouped into one object if they share the usage quota and access rights. This means that the same users and products can appear multiple times in the response. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      limits:
                        - limit_type: daily
                          limit_exceeded: false
                          users:
                            - ''
                          products:
                            - TCA-0207 File Dynamic Analysis
                          limit: 100
                        - limit_type: daily
                          limit_exceeded: false
                          users:
                            - ''
                          products:
                            - TCA-0319 YARA Retroactive Hunting
                          limit: 20
                        - limit_type: count
                          limit_exceeded: false
                          users:
                            - ''
                          products:
                            - TCA-0303 YARA Hunting
                          limit: 400
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      limits:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - limit_type
                            - limit_exceeded
                          properties:
                            limit:
                              type: integer
                            limit_size:
                              type: object
                              required:
                                - value
                                - unit
                              properties:
                                value:
                                  type: integer
                                unit:
                                  type: string
                                  enum:
                                    - GB
                            limit_size_per_file:
                              type: object
                              required:
                                - value
                                - unit
                              properties:
                                value:
                                  type: integer
                                unit:
                                  type: string
                                  enum:
                                    - GB
                            free_flex:
                              type: object
                              required:
                                - start_date
                                - end_date
                              properties:
                                start_date:
                                  type: string
                                  format: date
                                end_date:
                                  type: string
                                  format: date
                                limit_size:
                                  type: object
                                  required:
                                    - value
                                    - unit
                                  properties:
                                    value:
                                      type: integer
                                    unit:
                                      type: string
                                      enum:
                                        - GB
                            limit_type:
                              type: string
                            limit_exceeded:
                              type: boolean
                            products:
                              type: array
                              items:
                                required: []
                                properties: {}
                            users:
                              type: array
                              items:
                                required: []
                                properties: {}
                            start_date:
                              type: string
                              format: date
                            end_date:
                              type: string
                              format: date
                            allocation:
                              type: array
                              items:
                                type: object
                                required:
                                  - name
                                  - size
                                properties:
                                  name:
                                    type: string
                                  size:
                                    type: object
                                    required:
                                      - value
                                      - unit
                                    properties:
                                      value:
                                        type: integer
                                      unit:
                                        type: string
                            entitlements:
                              type: object
                              required:
                                - max_package_size
                              properties:
                                max_package_size:
                                  type: integer
                              additionalProperties:
                                type: boolean
                    required:
                      - limits
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/customer_usage/v1/limits?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/customer_usage/v1/limits?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/customer_usage/v1/limits/company:
    get:
      summary: 'TCA-9999: Quota Limits (company)'
      tags:
        - Customer Administration & Usage
      operationId: get-api-customer_usage-v1-limits-company
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
      description: 'This query returns current quota limits for APIs accessible to the authenticated user or users belonging to the authenticated user''s company. Products are grouped into one object if they share the usage quota and access rights. This means that the same users and products can appear multiple times in the response. '
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      limits:
                        - limit_type: daily
                          limit_exceeded: false
                          users:
                            - ''
                          products:
                            - TCA-0207 File Dynamic Analysis
                          limit: 100
                        - limit_type: daily
                          limit_exceeded: false
                          users:
                            - ''
                          products:
                            - TCA-0319 YARA Retroactive Hunting
                          limit: 20
                        - limit_type: count
                          limit_exceeded: false
                          users:
                            - ''
                          products:
                            - TCA-0303 YARA Hunting
                          limit: 400
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      limits:
                        type: array
                        uniqueItems: true
                        minItems: 1
                        items:
                          required:
                            - limit_type
                            - limit_exceeded
                          properties:
                            limit:
                              type: integer
                            limit_size:
                              type: object
                              required:
                                - value
                                - unit
                              properties:
                                value:
                                  type: integer
                                unit:
                                  type: string
                                  enum:
                                    - GB
                            limit_size_per_file:
                              type: object
                              required:
                                - value
                                - unit
                              properties:
                                value:
                                  type: integer
                                unit:
                                  type: string
                                  enum:
                                    - GB
                            limit_type:
                              type: string
                            limit_exceeded:
                              type: boolean
                            products:
                              type: array
                              items:
                                required: []
                                properties: {}
                            users:
                              type: array
                              items:
                                required: []
                                properties: {}
                            start_date:
                              type: string
                              format: date
                            end_date:
                              type: string
                              format: date
                            allocation:
                              type: array
                              items:
                                type: object
                                required:
                                  - name
                                  - size
                                properties:
                                  name:
                                    type: string
                                  size:
                                    type: object
                                    required:
                                      - value
                                      - unit
                                    properties:
                                      value:
                                        type: integer
                                      unit:
                                        type: string
                            entitlements:
                              type: object
                              required:
                                - max_package_size
                              properties:
                                max_package_size:
                                  type: integer
                              additionalProperties:
                                type: boolean
                    required:
                      - limits
                required:
                  - rl
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: |
            curl --url 'https://data.reversinglabs.com/api/customer_usage/v1/limits/company?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/customer_usage/v1/limits?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters: []
  /api/customer_usage/v1/alerts:
    get:
      summary: 'TCA-9999: List Configured Email Alerts'
      tags:
        - Customer Administration & Usage
      operationId: api_customer_usage_v1_alerts
      description: |
        Returns a list of configured email alerts for product usage thresholds. Each alert includes the product ID, enabled status, configured threshold percentages, and a list of email recipients.
      responses:
        '200':
          description: A list of existing alert configurations.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      alerts:
                        type: array
                        items:
                          type: object
                          required:
                            - product_id
                            - emails
                            - thresholds
                            - enabled
                          properties:
                            product_id:
                              type: string
                              enum:
                                - TCA-0101
                                - TCA-0103
                                - TCA-0104
                                - TCA-0105
                                - TCA-0106
                                - TCA-0201
                                - TCA-0202
                                - TCA-0203
                                - TCA-0204
                                - TCA-0205
                                - TCA-0206
                                - TCA-0207
                                - TCA-0207-URL
                                - TCA-0301
                                - TCA-0302
                                - TCA-0303
                                - TCA-0319
                                - TCA-0320
                                - TCA-0321
                                - TCA-0401
                                - TCA-0402
                                - TCA-0403
                                - TCA-0404
                                - TCA-0405
                                - TCA-0406
                                - TCA-0407
                                - TCA-0501
                                - TCA-0502
                                - TCA-0503
                                - TCAI-0001
                                - TCAI-0011
                                - TCAI-0106
                                - TCAI-0320
                            emails:
                              type: array
                              items:
                                type: string
                                format: email
                            thresholds:
                              type: array
                              items:
                                type: integer
                                minimum: 1
                                maximum: 100
                            enabled:
                              type: boolean
              example:
                rl:
                  alerts:
                    - product_id: TCA-0101
                      emails:
                        - user@example.com
                      thresholds:
                        - 50
                        - 100
                      enabled: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/customer_usage/v1/alert:
    post:
      summary: 'TCA-9999: Create or Update an Email Alert'
      tags:
        - Customer Administration & Usage
      operationId: api_customer_usage_v1_alert
      description: |
        Creates a new alert or updates an existing alert configuration for a specific product ID. Each alert defines the usage thresholds, list of email recipients, and enabled status.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                rl:
                  type: object
                  properties:
                    alert:
                      type: object
                      required:
                        - product_id
                        - emails
                        - thresholds
                        - enabled
                      properties:
                        product_id:
                          type: string
                          enum:
                            - TCA-0101
                            - TCA-0103
                            - TCA-0104
                            - TCA-0105
                            - TCA-0106
                            - TCA-0201
                            - TCA-0202
                            - TCA-0203
                            - TCA-0204
                            - TCA-0205
                            - TCA-0206
                            - TCA-0207
                            - TCA-0207-URL
                            - TCA-0301
                            - TCA-0302
                            - TCA-0303
                            - TCA-0319
                            - TCA-0320
                            - TCA-0321
                            - TCA-0401
                            - TCA-0402
                            - TCA-0403
                            - TCA-0404
                            - TCA-0405
                            - TCA-0406
                            - TCA-0407
                            - TCA-0501
                            - TCA-0502
                            - TCA-0503
                            - TCAI-0001
                            - TCAI-0011
                            - TCAI-0106
                            - TCAI-0320
                        emails:
                          type: array
                          items:
                            type: string
                            format: email
                        thresholds:
                          type: array
                          items:
                            type: integer
                            minimum: 1
                            maximum: 100
                        enabled:
                          type: boolean
            example:
              rl:
                alert:
                  product_id: TCA-0101
                  emails:
                    - user@example.com
                  thresholds:
                    - 50
                    - 100
                  enabled: true
      responses:
        '200':
          description: Alert successfully created or updated.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/customer_usage/v1/management/users:
    post:
      tags:
        - Customer Administration & Usage
      summary: 'TCA-9999: Create User'
      description: Creates a new user. This is the only user-related endpoint that returns a password for the created user. If the password is lost, create a new password using the reset-password endpoint. Users cannot be deleted, only disabled. There is a global limit of 1000 users, after which no new users can be created.
      operationId: createUser
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateUserRequest'
            examples:
              example:
                value:
                  username: username
                  email_addresses:
                    - email1@gmail.com
                    - email2@gmail.com
                  description: User description
                  enabled: true
      responses:
        '201':
          description: User created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateUserResponse'
              examples:
                example:
                  value:
                    rl:
                      created_at: 2025-10-15T05:21:38+0000
                      description: User description
                      email_addresses:
                        - email1@gmail.com
                        - email2@gmail.com
                      enabled: true
                      password: p4ssw0rd
                      updated_at: null
                      username: u/company/user
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
    get:
      tags:
        - Customer Administration & Usage
      summary: 'TCA-9999: List Users'
      description: Returns a list of all users in the company.
      operationId: listUsers
      parameters:
        - name: page
          in: query
          required: false
          description: Return a specific page
          schema:
            type: integer
            minimum: 1
        - name: size
          in: query
          required: false
          description: The number of users to return per page
          schema:
            type: integer
            minimum: 1
      responses:
        '200':
          description: Users retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListUsersResponse'
              examples:
                example:
                  value:
                    rl:
                      page:
                        current_page: 1
                        next: /api/customer_usage/v1/management/users?size=5&page=2
                        previous: null
                        total_pages: 3
                        total_records: 11
                      users:
                        - created_at: 2024-07-26T09:09:46+0000
                          description: User description
                          email_addresses:
                            - user@example.com
                          enabled: true
                          updated_at: null
                          username: u/company/user/1234
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
    components:
      schemas:
        CreateUserRequest:
          type: object
          required:
            - username
            - email_addresses
            - enabled
          properties:
            username:
              type: string
              description: |
                The username of the user to create. Must be alphanumeric; "/" is allowed. This is the last segment of the username,  without the `/u/company/` prefix. The first and the last character must be alphanumeric. Can't contain "test", "demo", "temp" or "trial".
              minLength: 1
              pattern: ^[A-Za-z0-9](?:[A-Za-z0-9/]*[A-Za-z0-9])?$
            email_addresses:
              type: array
              description: The email addresses of the user to create.
              items:
                type: string
                format: email
              minItems: 1
              uniqueItems: true
            description:
              type: string
              description: The description of the user to create.
            enabled:
              type: boolean
              description: Whether the user is enabled.
        CreateUserResponse:
          type: object
          properties:
            rl:
              type: object
              properties:
                created_at:
                  type: string
                  description: Creation timestamp.
                  example: 2025-10-15T05:21:38+0000
                description:
                  type: string
                  description: User description.
                email_addresses:
                  type: array
                  items:
                    type: string
                    format: email
                enabled:
                  type: boolean
                  description: Whether the user is enabled.
                password:
                  type: string
                  description: Returned only on creation.
                updated_at:
                  type: string
                  nullable: true
                  description: Update timestamp or null if never updated.
                username:
                  type: string
                  description: The username.
              required:
                - created_at
                - email_addresses
                - enabled
                - password
                - username
          required:
            - rl
        ListUsersResponse:
          type: object
          properties:
            rl:
              type: object
              properties:
                page:
                  type: object
                  properties:
                    current_page:
                      type: integer
                      description: Current page number.
                    next:
                      type: string
                      nullable: true
                      description: URL for next page or null if last page.
                    previous:
                      type: string
                      nullable: true
                      description: URL for previous page or null if first page.
                    total_pages:
                      type: integer
                      description: Total number of pages.
                    total_records:
                      type: integer
                      description: Total number of records.
                  required:
                    - current_page
                    - total_pages
                    - total_records
                users:
                  type: array
                  items:
                    type: object
                    properties:
                      created_at:
                        type: string
                        description: Creation timestamp.
                      description:
                        type: string
                        description: User description.
                      email_addresses:
                        type: array
                        items:
                          type: string
                          format: email
                      enabled:
                        type: boolean
                        description: Whether the user is enabled.
                      updated_at:
                        type: string
                        nullable: true
                        description: Update timestamp or null if never updated.
                      username:
                        type: string
                        description: The username.
                    required:
                      - created_at
                      - email_addresses
                      - enabled
                      - username
              required:
                - page
                - users
          required:
            - rl
  /api/customer_usage/v1/management/users/{username}:
    get:
      tags:
        - Customer Administration & Usage
      summary: 'TCA-9999: Retrieve User'
      description: Retrieves information about a specific user.
      operationId: getUser
      parameters:
        - name: username
          in: path
          required: true
          description: The username (base64-encoded)
          schema:
            type: string
      responses:
        '200':
          description: User information retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserResponse'
              examples:
                example:
                  value:
                    rl:
                      created_at: 2025-10-15T05:21:38+0000
                      description: Test user
                      email_addresses:
                        - self.service@test.com
                      enabled: true
                      updated_at: null
                      username: u/company/username
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
    put:
      tags:
        - Customer Administration & Usage
      summary: 'TCA-9999: Update User'
      description: Updates an existing user. All fields are optional.
      operationId: updateUser
      parameters:
        - name: username
          in: path
          required: true
          description: The username (base64-encoded)
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUserRequest'
            examples:
              example:
                value:
                  description: Updated user for integration testing
                  email_addresses:
                    - self.service@test.com
                    - secondary.contact@test.com
                  enabled: false
      responses:
        '200':
          description: User updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserResponse'
              examples:
                example:
                  value:
                    rl:
                      created_at: 2025-10-15T05:21:38+0000
                      description: Updated user for integration testing
                      email_addresses:
                        - self.service@test.com
                        - secondary.contact@test.com
                      enabled: false
                      updated_at: 2025-10-15T05:28:57+0000
                      username: u/neworg/selfservice1234
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
    components:
      schemas:
        UpdateUserRequest:
          type: object
          properties:
            description:
              type: string
              description: The description of the user.
            email_addresses:
              type: array
              description: The email addresses of the user.
              items:
                type: string
                format: email
              minItems: 1
              uniqueItems: true
            enabled:
              type: boolean
              description: Whether the user is enabled.
        CreateUserRequest:
          type: object
          required:
            - username
            - email_addresses
            - enabled
          properties:
            username:
              type: string
              description: |
                The username of the user to create. Must be alphanumeric; "/" is allowed. The first and the last character must be alphanumeric. Can't contain "test", "demo", "temp" or "trial".
              minLength: 1
              pattern: ^[A-Za-z0-9](?:[A-Za-z0-9/]*[A-Za-z0-9])?$
            email_addresses:
              type: array
              description: The email addresses of the user to create.
              items:
                type: string
                format: email
              minItems: 1
              uniqueItems: true
            description:
              type: string
              description: The description of the user to create.
            enabled:
              type: boolean
              description: Whether the user is enabled.
        CreateUserResponse:
          type: object
          properties:
            rl:
              type: object
              properties:
                created_at:
                  type: string
                  description: Creation timestamp.
                  example: 2025-10-15T05:21:38+0000
                description:
                  type: string
                email_addresses:
                  type: array
                  items:
                    type: string
                    format: email
                enabled:
                  type: boolean
                password:
                  type: string
                  description: Returned only on creation.
                updated_at:
                  type: string
                  nullable: true
                  description: Update timestamp or null if never updated.
                username:
                  type: string
              required:
                - created_at
                - email_addresses
                - enabled
                - password
                - username
            required:
              - rl
        UserResponse:
          type: object
          properties:
            rl:
              type: object
              properties:
                created_at:
                  type: string
                  description: Creation timestamp.
                  example: 2025-10-15T05:21:38+0000
                description:
                  type: string
                  description: User description.
                email_addresses:
                  type: array
                  items:
                    type: string
                    format: email
                enabled:
                  type: boolean
                  description: Whether the user is enabled.
                updated_at:
                  type: string
                  nullable: true
                  description: Update timestamp or null if never updated.
                username:
                  type: string
                  description: The username.
              required:
                - created_at
                - email_addresses
                - enabled
                - username
          required:
            - rl
  /api/customer_usage/v1/management/users/{username}/password-reset:
    put:
      tags:
        - Customer Administration & Usage
      summary: 'TCA-9999: Reset Password'
      description: Resets the user's password. The old_password_expiration_date is optional. If not provided, the password rotation grace period defaults to 1 hour from the time of the request.
      operationId: resetUserPassword
      parameters:
        - name: username
          in: path
          required: true
          description: The username (base64-encoded)
          schema:
            type: string
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordResetRequest'
            examples:
              example:
                value:
                  old_password_expiration_date: '2025-11-01T00:00:00Z'
      responses:
        '200':
          description: Password reset successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordResetResponse'
              examples:
                example:
                  value:
                    rl:
                      password: n3wp4ssw0rd
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
    components:
      schemas:
        PasswordResetRequest:
          type: object
          properties:
            old_password_expiration_date:
              type: string
              format: date-time
              description: Optional expiration date for the old password. If not provided, defaults to 1 hour from request time.
              example: '2025-11-01T00:00:00Z'
        PasswordResetResponse:
          type: object
          properties:
            rl:
              type: object
              properties:
                password:
                  type: string
                  description: The new password.
              required:
                - password
          required:
            - rl
  /api/feed/malware/detection/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0101 New Malware - Files
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          headers: {}
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      malware_detection_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha1
                                - sample_size
                                - sample_type
                                - platform
                                - sha256
                                - md5
                              properties:
                                sha1:
                                  type: string
                                sample_size:
                                  type: string
                                sample_type:
                                  type: string
                                platform:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - malware_detection_feed
                required:
                  - rl
              example:
                rl:
                  malware_detection_feed:
                    time_range:
                      from: '2025-01-01T00:00:00'
                      to: '2025-01-01T00:00:49'
                    entries:
                      - sha1: 001de76fd2a34231088570035117fa6a98966ae6
                        md5: 23339279646ae9cb332a01a8118c023c
                        sha256: e86a780e360fdc20363662c1004c6f64b3461961664830bb4ec8666c66df5f0d
                        sample_type: PE32+ executable (console) x86-64, for MS Windows, 8 sections
                        sample_size: '1818053'
                        platform: Win32
                      - sha1: 006b4adf7eee7d53e554219365c298b0022fab6f
                        md5: 31889852c29b5428cecd1c07885f8880
                        sha256: dd084cd2fc6a824310274e9b2eaaaa222af27815f9596871143e619fce88fca5
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
                        sample_size: '342282'
                        platform: Win32
                      - sha1: 0294c49f734e92f5608bc54449fd14c63727829f
                        md5: 3198b663a21b5a0cc769fb5691dda32c
                        sha256: 54354a85ec8e987bd4432ab6a62c408ed40ea0b32dd569668399c984773b1cba
                        sample_type: PE32+ executable (console) x86-64, for MS Windows, 8 sections
                        sample_size: '1773272'
                        platform: Win32
                    last_timestamp: '2025-01-01T00:00:49'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-detection-v1-query
      description: |-
        This query returns malware detections from the requested timestamp. The feed will return 1000 records at most, or a little bit more than 1000 if there are some records with the same timestamp.

        To fetch the next batch of records, use the timestamp from the response increased by 1.
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/detection/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/detection/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/detection/platform/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0102 - 0106 New Malware - Platform Filtered
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      malware_detection_platform_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha1
                                - record_on
                                - sample_type
                                - platform
                                - sha256
                                - md5
                              properties:
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                sample_type:
                                  type: string
                                platform:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - malware_detection_platform_feed
                required:
                  - rl
              example:
                rl:
                  malware_detection_platform_feed:
                    time_range:
                      from: '2025-01-01T00:00:00'
                      to: '2025-01-01T00:00:49'
                    entries:
                      - sha1: 001de76fd2a34231088570035117fa6a98966ae6
                        md5: 23339279646ae9cb332a01a8118c023c
                        sha256: e86a780e360fdc20363662c1004c6f64b3461961664830bb4ec8666c66df5f0d
                        sample_type: PE32+ executable (console) x86-64, for MS Windows, 8 sections
                        platform: Win32
                        record_on: '2025-01-01T00:00:04'
                      - sha1: 006b4adf7eee7d53e554219365c298b0022fab6f
                        md5: 31889852c29b5428cecd1c07885f8880
                        sha256: dd084cd2fc6a824310274e9b2eaaaa222af27815f9596871143e619fce88fca5
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
                        platform: Win32
                        record_on: '2025-01-01T00:00:04'
                      - sha1: 0294c49f734e92f5608bc54449fd14c63727829f
                        md5: 3198b663a21b5a0cc769fb5691dda32c
                        sha256: 54354a85ec8e987bd4432ab6a62c408ed40ea0b32dd569668399c984773b1cba
                        sample_type: PE32+ executable (console) x86-64, for MS Windows, 8 sections
                        platform: Win32
                        record_on: '2025-01-01T00:00:04'
                    last_timestamp: '2025-01-01T00:00:49'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-detection-platform-v1-query
      description: This service provides information about new malware samples with detections in the Spectra Intelligence system. The samples are filtered by platform.
      parameters:
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
        - schema:
            type: string
            enum:
              - Android
              - Boot
              - ByteCode
              - Document
              - DOS
              - Firmware
              - FreeBSD
              - iOS
              - Linux
              - MacOS
              - OS2
              - Palm
              - Script
              - Symbian
              - Unix
              - Unknown
              - Win32
              - Win64
            example: Android&platform=Linux
          in: query
          name: platform
          description: One or more values from the list of supported platform names.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/detection/platform/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/detection/platform/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/detection/platform/v1/query/start/{time_format}/{time_value}:
    put:
      summary: TCF-0102 - 0106 New Malware - Platform Filtered (Start)
      operationId: put-api-feed-malware-detection-platform-v1-query-start
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      tags:
        - Malicious File Indicators
      description: This query sets the starting timestamp for the `pull` query.
      x-codeSamples:
        - lang: bash
          source: |
            curl --location --request PUT 'https://data.reversinglabs.com/api/feed/malware/detection/platform/v1/query/start/utc/2025-01-01T00:00:00' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/detection/platform/v1/query/start/utc/2025-01-01T00:00:00"
            response = requests.put(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/detection/platform/v1/query/pull:
    get:
      summary: TCF-0102 - 0106 New Malware - Platform Filtered (Pull)
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      malware_detection_platform_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha1
                                - record_on
                                - sample_type
                                - platform
                                - sha256
                                - md5
                              properties:
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                sample_type:
                                  type: string
                                platform:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - malware_detection_platform_feed
                required:
                  - rl
              example:
                rl:
                  malware_detection_platform_feed:
                    time_range:
                      from: '2024-01-22T12:15:03'
                      to: '2024-01-22T12:15:59'
                    entries:
                      - sha1: 003614d9c5fc5bd46b8367495d8b1056786ad7d4
                        md5: 14169e86f460c6c5b45b3fbd7f4c40fe
                        sha256: 844980f04943ae23d895d74c11f7eb96914be298202e10bd2324e1e93799301d
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections
                        platform: Win32
                        record_on: '2024-01-22T12:15:06'
                      - sha1: 01756dfd5ac9dcb42de026a949dc91bbe8f6c08b
                        md5: aeb5833d541ff0abd7d1e3f4da058aa4
                        sha256: 461b72193f4580aa0618e6652cab796d58f3a8806dd47b17c5168af8aa74da33
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, PECompact2 compressed, 2 sections
                        platform: Win32
                        record_on: '2024-01-22T12:15:06'
                      - sha1: 0374b539c366f549629b0d18b45330f9c71d67be
                        md5: 1e4b471bf060123d9f9ffb193c92810f
                        sha256: e8ffe4e4bf337a4193e8c7c27986433801bd4ad593acb6bc3c86e9470a78e205
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections
                        platform: Win32
                        record_on: '2024-01-22T12:15:06'
                    last_timestamp: 1705925759
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-detection-platform-v1-query-pull
      description: This service provides information about new malware samples with detections in the Spectra Intelligence system, starting with the timestamp defined with the `start` query.
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/detection/platform/v1/query/pull?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/detection/platform/v1/query/pull?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/feed/malware/first_scan/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0107 Files Scanned for the First Time (Continuous)
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - malware_first_scan_feed
                    properties:
                      malware_first_scan_feed:
                        type: object
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                sample_type:
                                  type: string
                                md5:
                                  type: string
                              required:
                                - sha256
                                - sha1
                                - sample_type
                                - md5
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            required:
                              - to
                              - from
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                required:
                  - rl
              example:
                rl:
                  malware_first_scan_feed:
                    time_range:
                      from: '2025-01-01T00:00:00'
                      to: '2025-01-01T00:00:49'
                    entries:
                      - sha1: 006b4adf7eee7d53e554219365c298b0022fab6f
                        md5: 31889852c29b5428cecd1c07885f8880
                        sha256: dd084cd2fc6a824310274e9b2eaaaa222af27815f9596871143e619fce88fca5
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
                      - sha1: 00f93bdd9b283c75395cf818c4f61c122d118138
                        md5: 68a803c98c1a8f53c900aa0d6948b6e0
                        sha256: 3dc67b2fcc99adcc077e199fb832967fef8d94cade7904354951b2c9db038926
                        sample_type: HTML document, ASCII text, with CRLF line terminators
                      - sha1: 01400a852bc32d687eab13640013c57e25135955
                        md5: dbd19645c7c3ad864066bc5f017b082b
                        sha256: a740f412bac0074e56c1333db3a41dc57ca47b012eb688b37f73c37261f6b912
                        sample_type: Rich Text Format data, version 1, ANSI, code page 1252
                    last_timestamp: '2025-01-01T00:00:49'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-first_scan-v1-query
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/first_scan/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/first_scan/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      description: This service provides a continuous list of hashes for samples collected from various sources and scanned with the VTEST AV scanning system for the first time in Spectra Intelligence system.
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/first_scan/v1/query/start/{time_format}/{time_value}:
    put:
      summary: TCF-0107 Files Scanned for the First Time (Start)
      operationId: put-api-feed-malware-first_scan-v1-query-start
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      tags:
        - Malicious File Indicators
      description: This query sets the starting timestamp for the `pull` query.
      x-codeSamples:
        - lang: bash
          source: |
            curl --location --request PUT 'https://data.reversinglabs.com/api/feed/malware/first_scan/v1/query/start/utc/2025-01-01T00:00:00' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/first_scan/v1/query/start/utc/2025-01-01T00:00:00"
            response = requests.put(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/first_scan/v1/query/pull:
    get:
      summary: TCF-0107 Files Scanned for the First Time (Pull)
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - malware_first_scan_feed
                    properties:
                      malware_first_scan_feed:
                        type: object
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                sample_type:
                                  type: string
                                md5:
                                  type: string
                              required:
                                - sha256
                                - sha1
                                - sample_type
                                - md5
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            required:
                              - to
                              - from
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                required:
                  - rl
              example:
                rl:
                  malware_first_scan_feed:
                    time_range:
                      from: '2025-01-01T13:00:00'
                      to: '2025-01-01T13:00:58'
                    entries:
                      - sha1: 02f22fa82e5bdc0e048f08e840c920cde5f992ae
                        md5: 4ea5fe096bd857397c0cdefb8cbd603d
                        sha256: 60a456fbbbf6ca61e99a1799fe152301ae50a74b6e8644c2b968f7e62fc6b003
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections
                      - sha1: 063b03ac7cdb95b36db895f23bc31cb30a754edb
                        md5: 5703180ce665480676126cf96b08376a
                        sha256: 89ba92ec26884f0f8db6dc80a2d7e540e8847157d5b9f2049054d1fa71c733a4
                        sample_type: Microsoft Excel 2007+
                      - sha1: 094e49790abfab1451b9c0031db999d085970c31
                        md5: 3910bebe89b1900f513ca3ad8587e9fe
                        sha256: f6479ac63bfe7410b6df3438a3373abdbdf9ea80c802a0c050495ceec742bab0
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections
                    last_timestamp: 1735736458
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-first_scan-v1-query-pull
      description: This query returns a list of hashes for samples scanned for the first time, starting with the timestamp defined with the `start` query.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/first_scan/v1/query/pull?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/first_scan/v1/query/pull?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
  /api/feed/malware/scan/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0108 New Files - First and Re-Scan (Continuous)
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - malware_scan_feed
                    properties:
                      malware_scan_feed:
                        type: object
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                sample_type:
                                  type: string
                                md5:
                                  type: string
                              required:
                                - sha256
                                - sha1
                                - sample_type
                                - md5
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            required:
                              - to
                              - from
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                required:
                  - rl
              example:
                rl:
                  malware_scan_feed:
                    time_range:
                      from: '2025-01-01T00:00:00'
                      to: '2025-01-01T00:00:49'
                    entries:
                      - sha1: 006b4adf7eee7d53e554219365c298b0022fab6f
                        md5: 31889852c29b5428cecd1c07885f8880
                        sha256: dd084cd2fc6a824310274e9b2eaaaa222af27815f9596871143e619fce88fca5
                        single: 'True'
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
                        record_on: '2025-01-01T00:00:02'
                      - sha1: 00f93bdd9b283c75395cf818c4f61c122d118138
                        md5: 68a803c98c1a8f53c900aa0d6948b6e0
                        sha256: 3dc67b2fcc99adcc077e199fb832967fef8d94cade7904354951b2c9db038926
                        single: 'True'
                        sample_type: HTML document, ASCII text, with CRLF line terminators
                        record_on: '2025-01-01T00:00:02'
                      - sha1: 010475de05083499201b62763da4fe9c17487836
                        md5: 12370a49c4f6fa8e37ac28a6fee809ac
                        sha256: 75752cf0057aa6d72ee5791d2b7d7cc6f65777b140035e7facb904d4141cc1fb
                        single: 'False'
                        sample_type: HTML document, Unicode text, UTF-8 text, with very long lines (1713)
                        record_on: '2025-01-01T00:00:02'
                      - sha1: 01400a852bc32d687eab13640013c57e25135955
                        md5: dbd19645c7c3ad864066bc5f017b082b
                        sha256: a740f412bac0074e56c1333db3a41dc57ca47b012eb688b37f73c37261f6b912
                        single: 'True'
                        sample_type: Rich Text Format data, version 1, ANSI, code page 1252
                        record_on: '2025-01-01T00:00:02'
                      - sha1: 015fa9dab4f031e734a1702381dfe05712dcf9f2
                        md5: b49d3a06a41bed758f9e2fea8e8afd30
                        sha256: c7d79512b20b871f65bba88fa0fc26180bbb50efdf6a63137fe1ae2bf9cdd14e
                        single: 'True'
                        sample_type: ASCII text, with very long lines (64337)
                        record_on: '2025-01-01T00:00:02'
                    last_timestamp: '2025-01-01T00:00:49'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-scan-v1-query
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      description: This service provides a continuous list of samples in the Spectra Intelligence system which have been scanned for the first time or rescanned with the VTEST AV scanner system.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/scan/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/scan/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/scan/v1/query/start/{time_format}/{time_value}:
    put:
      summary: TCF-0108 New Files - First and Re-Scan (Start)
      operationId: put-api-feed-malware-scan-v1-query-start
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      tags:
        - Malicious File Indicators
      description: This query sets the starting timestamp for the `pull` query.
      x-codeSamples:
        - lang: bash
          source: |
            curl --location --request PUT 'https://data.reversinglabs.com/api/feed/malware/scan/v1/query/start/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/scan/v1/query/start/utc/2025-01-01T00:00:00?format=json"
            response = requests.put(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/scan/v1/query/pull:
    get:
      summary: TCF-0108 New Files - First and Re-Scan (Pull)
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - malware_scan_feed
                    properties:
                      malware_scan_feed:
                        type: object
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                sample_type:
                                  type: string
                                md5:
                                  type: string
                              required:
                                - sha256
                                - sha1
                                - sample_type
                                - md5
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            required:
                              - to
                              - from
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                required:
                  - rl
              example:
                rl:
                  malware_scan_feed:
                    time_range:
                      from: '2024-01-31T13:42:59'
                      to: '2024-01-31T13:43:59'
                    entries:
                      - sha1: 015e6efbc812a12e1945ef44698b319bd3758969
                        md5: 03b9c18acfb0ffcd2218fd93bd8e0245
                        sha256: 9ee73a44909d412176e41d4fa4b69d42ef3ef3132b6093eb5ef874282869bb52
                        single: 'True'
                        sample_type: PDF document, version 1.4, 23 pages
                        record_on: '2024-01-31T13:43:00'
                      - sha1: 01925e90892ab366dbae17a6eebb529162745ad2
                        md5: c92eeda9d600b56485d11e9d004eeb56
                        sha256: 93a1c4812a117fb62642fcbf7be8dd04ac9cf94b4892c709dc6f73a35aec4c4b
                        single: 'True'
                        sample_type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, 5 sections
                        record_on: '2024-01-31T13:43:00'
                      - sha1: 01b105fca925ecb5a650f393fb7b14b17765eca7
                        md5: 91215401d00d66cba62c944437df11fa
                        sha256: d1c9236349d739c9671d76f7579b7eea4cb3991c6aabf329f903d6087b74f94c
                        single: 'True'
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections
                        record_on: '2024-01-31T13:43:00'
                      - sha1: 0253cc32a13c76a9df5a2ced5195d19fb1512aec
                        md5: 71dbf4a131365088a9728f33cb7236f0
                        sha256: eac9482a67f092ab52b80c13281d0798bfa5f143f9944c151f9709a9f6f7e3e6
                        single: 'True'
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections
                        record_on: '2024-01-31T13:43:00'
                      - sha1: 0256932e0c1dab08a7f0f7220821d745d1c54230
                        md5: 6857e5ae6b68470cfe2be2affe6f14be
                        sha256: 354f49148c88330d29237cfe6344daf36ab155dd4920fcb1b58a497517ce27a4
                        single: 'True'
                        sample_type: compiled Java class data, version 52.0 (Java 1.8)
                        record_on: '2024-01-31T13:43:00'
                    last_timestamp: 1706708639
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-scan-v1-query-pull
      description: This query returns a list of hashes for scanned samples (first time or rescan), starting with the timestamp defined with the `start` query.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/scan/v1/query/pull?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/scan/v1/query/pull?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
  /api/feed/malware/scan/change/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0109 Files with Detection Changes (Continuous)
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - malware_scan_change_feed
                    properties:
                      malware_scan_change_feed:
                        type: object
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                sample_type:
                                  type: string
                                md5:
                                  type: string
                              required:
                                - sha256
                                - sha1
                                - sample_type
                                - md5
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            required:
                              - to
                              - from
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                required:
                  - rl
              example:
                rl:
                  malware_scan_change_feed:
                    time_range:
                      from: '2025-01-01T00:00:00'
                      to: '2025-01-01T00:00:49'
                    entries:
                      - sha1: 001de76fd2a34231088570035117fa6a98966ae6
                        md5: 23339279646ae9cb332a01a8118c023c
                        sha256: e86a780e360fdc20363662c1004c6f64b3461961664830bb4ec8666c66df5f0d
                        sample_type: PE32+ executable (console) x86-64, for MS Windows, 8 sections
                        record_on: '2025-01-01T00:00:04'
                      - sha1: 006b4adf7eee7d53e554219365c298b0022fab6f
                        md5: 31889852c29b5428cecd1c07885f8880
                        sha256: dd084cd2fc6a824310274e9b2eaaaa222af27815f9596871143e619fce88fca5
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
                        record_on: '2025-01-01T00:00:04'
                      - sha1: 00f93bdd9b283c75395cf818c4f61c122d118138
                        md5: 68a803c98c1a8f53c900aa0d6948b6e0
                        sha256: 3dc67b2fcc99adcc077e199fb832967fef8d94cade7904354951b2c9db038926
                        sample_type: HTML document, ASCII text, with CRLF line terminators
                        record_on: '2025-01-01T00:00:04'
                    last_timestamp: '2025-01-01T00:00:49'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-scan-change-v1-query
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      description: This service provides a continuous list of records about samples in the Spectra Intelligence system that show detection changes in their VTEST reports.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/scan/change/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/scan/change/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/scan/change/v1/query/start/{time_format}/{time_value}:
    put:
      summary: TCF-0109 Files with Detection Changes (Start)
      operationId: put-api-feed-malware-scan-change-v1-query-start
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      tags:
        - Malicious File Indicators
      description: This query sets the starting timestamp for the `pull` query.
      x-codeSamples:
        - lang: bash
          source: |
            curl --location --request PUT 'https://data.reversinglabs.com/api/feed/malware/scan/change/v1/query/start/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/scan/change/v1/query/start/utc/2025-01-01T00:00:00?format=json"
            response = requests.put(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/scan/change/v1/query/pull:
    get:
      summary: TCF-0109 Files with Detection Changes (Pull)
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - malware_scan_change_feed
                    properties:
                      malware_scan_change_feed:
                        type: object
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              type: object
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                sample_type:
                                  type: string
                                md5:
                                  type: string
                              required:
                                - sha256
                                - sha1
                                - sample_type
                                - md5
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            required:
                              - to
                              - from
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                required:
                  - rl
              example:
                rl:
                  malware_scan_change_feed:
                    time_range:
                      from: '2024-01-22T10:32:17'
                      to: '2024-01-22T10:32:57'
                    entries:
                      - sha1: 0021a713f31cc84fed7b710791d3155e46409321
                        md5: ee940fd981feec92846942fdeaa5f787
                        sha256: e20f8665b00726d1be61c86e7fd926f645f9eb197f8ea088d90fcfaf813cedcd
                        sample_type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 9 sections
                        record_on: '2024-01-22T10:32:18'
                        changed_result_scanners:
                          - ''
                      - sha1: 005ea4312051d6d59f290b6f4229cc6aa22a784e
                        md5: 91343f5be00f0e1450e21e281a7ee6dc
                        sha256: eac74bca80cc12b0051329f4aa8ffd76e6b2f63ea1f38fef5f30b3f4e50318e3
                        sample_type: HTML document, Non-ISO extended-ASCII text, with very long lines (535), with CRLF line terminators
                        record_on: '2024-01-22T10:32:18'
                      - sha1: 0096d2c70cf5e5f57fc54d995df925bd997acf99
                        md5: e3f10da3bbf0e728eb432c216a5b1799
                        sha256: 6f1e77d949ab1500d56cc6a4bdff881f3ff475812fed1e83a875ede420d44a15
                        sample_type: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
                        record_on: '2024-01-22T10:32:18'
                        changed_result_scanners:
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                          - ''
                    last_timestamp: 1705919577
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-scan-change-v1-query-pull
      description: This query returns a list of hashes for scanned samples (first time scan or detection change), starting with the timestamp defined with the `start` query.
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/scan/change/v1/query/pull?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/scan/change/v1/query/pull?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/feed/mwp_change_events/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0111 MWP Change Events Feed (Continuous)
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      mwp_change_events_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha1
                                - record_on
                                - event_type
                                - classification
                                - sample_size
                                - sample_type
                                - threat_name
                                - sha256
                                - md5
                              properties:
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                event_type:
                                  type: string
                                classification:
                                  type: string
                                sample_size:
                                  type: string
                                sample_type:
                                  type: string
                                threat_name:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - mwp_change_events_feed
                required:
                  - rl
              example:
                rl:
                  mwp_change_events_feed:
                    time_range:
                      from: '2025-01-01T00:00:00'
                      to: '2025-01-01T00:00:53'
                    entries:
                      - sha1: 001de76fd2a34231088570035117fa6a98966ae6
                        sha256: e86a780e360fdc20363662c1004c6f64b3461961664830bb4ec8666c66df5f0d
                        md5: 23339279646ae9cb332a01a8118c023c
                        event_type: NEW_MALICIOUS
                        classification: MALICIOUS
                        threat_name: Win64.Coinminer.XMRig
                        sample_size: '1818053'
                        sample_type: PE+/Exe
                        record_on: '2025-01-01T00:00:05'
                      - sha1: 006b4adf7eee7d53e554219365c298b0022fab6f
                        sha256: dd084cd2fc6a824310274e9b2eaaaa222af27815f9596871143e619fce88fca5
                        md5: 31889852c29b5428cecd1c07885f8880
                        event_type: NEW_MALICIOUS
                        classification: MALICIOUS
                        threat_name: Win32.Trojan.Dinwod
                        sample_size: '342282'
                        sample_type: PE/Exe
                        record_on: '2025-01-01T00:00:05'
                      - sha1: 0294c49f734e92f5608bc54449fd14c63727829f
                        sha256: 54354a85ec8e987bd4432ab6a62c408ed40ea0b32dd569668399c984773b1cba
                        md5: 3198b663a21b5a0cc769fb5691dda32c
                        event_type: NEW_MALICIOUS
                        classification: MALICIOUS
                        threat_name: Win64.Coinminer.XMRig
                        sample_size: '1773272'
                        sample_type: PE+/Exe
                        record_on: '2025-01-01T00:00:05'
                    last_timestamp: '2025-01-01T00:00:53'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-mwp_change_events-v1-query
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      description: This service provides a continuous list of records about samples in the Spectra Intelligence system that show detection changes in their VTEST reports.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com//api/feed/mwp_change_events/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com//api/feed/mwp_change_events/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/mwp_change_events/v1/query/start/{time_format}/{time_value}:
    put:
      summary: TCF-0111 MWP Change Events Feed (Start)
      operationId: put-api-feed-mwp_change_events-v1-query-start
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      tags:
        - Malicious File Indicators
      description: This query sets the starting timestamp for the `pull` query.
      x-codeSamples:
        - lang: bash
          source: |
            curl --location --request PUT 'https://data.reversinglabs.com//api/feed/mwp_change_events/v1/query/start/utc/2025-01-01T00:00:00' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com//api/feed/mwp_change_events/v1/query/start/utc/2025-01-01T00:00:00"
            response = requests.put(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/mwp_change_events/v1/query/pull:
    get:
      summary: TCF-0111 MWP Change Events Feed (Pull)
      tags:
        - Malicious File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      mwp_change_events_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha1
                                - record_on
                                - event_type
                                - classification
                                - sample_size
                                - sample_type
                                - threat_name
                                - sha256
                                - md5
                              properties:
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                event_type:
                                  type: string
                                classification:
                                  type: string
                                sample_size:
                                  type: string
                                sample_type:
                                  type: string
                                threat_name:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - mwp_change_events_feed
                required:
                  - rl
              example:
                rl:
                  mwp_change_events_feed:
                    time_range:
                      from: '2024-01-22T10:34:37'
                      to: '2024-01-22T10:34:58'
                    entries:
                      - sha1: 06bfdac48f9e1be8ab02a620836abdf990751bb9
                        sha256: d72a0c82ae16bfe9ab9f7fc487961771e082c961557f2b2f1c6ab13fca7479dd
                        md5: 8776d9bbe62a980bb1d9c62b2215d77f
                        event_type: THREAT_NAME_CHANGE
                        classification: MALICIOUS
                        threat_name: Win32.PUA.DirectDownload
                        sample_size: '523280'
                        sample_type: PE/Exe/NSIS
                        record_on: '2024-01-22T10:34:38'
                      - sha1: 0e8f6ebe5019177e6a396ca885da1575bdd61df6
                        sha256: 92c58ef3e84753ce57d33e24dbcfa41146109c1ea274dd44c2ca2f9cc45cb2df
                        md5: 44fca2ebaabc09c51000757ae7fb676d
                        event_type: NEW_MALICIOUS
                        classification: MALICIOUS
                        threat_name: Win32.Virus.Emdup
                        sample_size: '544091'
                        sample_type: PE/Exe
                        record_on: '2024-01-22T10:34:38'
                      - sha1: 10aa87d1a167d271b99aa12d703c57d4891861c6
                        sha256: d72a464f6817e90828b38a61e7b1b3f0debf869200d5cff65d27b2e0f5cad0fc
                        md5: 24ee46a8862d7d096b52dd2c5123c9d7
                        event_type: THREAT_NAME_CHANGE
                        classification: MALICIOUS
                        threat_name: Win32.Trojan.Kelihos
                        sample_size: '897536'
                        sample_type: PE/Exe
                        record_on: '2024-01-22T10:34:38'
                    last_timestamp: 1705919698
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-mwp_change_events-v1-query-pull
      description: This query returns a list of hashes for scanned samples (first time scan or detection change), starting with the timestamp defined with the `start` query.
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/mwp_change_events/v1/query/pull?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/mwp_change_events/v1/query/pull?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/cve/v1/{date}:
    get:
      summary: TCF-0201 CVEs Exploited in the Wild (by date)
      tags:
        - CVE and In-the-Wild Exploits
      responses:
        '200':
          description: OK
          content:
            text/plain:
              example: |
                2021-04-20
                CVE-2021-3156
                CVE-2021-27065
                CVE-2021-26855
                CVE-2021-26411
                CVE-2021-21206
                CVE-2021-1732
                CVE-2021-1647
                CVE-2020-7961
                CVE-2020-3153
                CVE-2020-16040
                CVE-2020-1472
                CVE-2020-1054
                CVE-2020-1048
                CVE-2020-0796
                CVE-2019-7123
                CVE-2019-2725
                CVE-2019-1405
                CVE-2019-1132
                CVE-2019-0841
              schema:
                type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-cve-v1
      description: This query returns a document containing a list of all detected CVE identifiers for the requested day.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/cve/v1/2025-01-01' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/cve/v1/2025-01-01"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - schema:
          type: string
          format: date
          example: '2020-04-20'
        name: date
        in: path
        required: true
  /api/cve/v1/latest:
    get:
      summary: TCF-0201 CVEs Exploited in the Wild (latest)
      tags:
        - CVE and In-the-Wild Exploits
      responses:
        '200':
          description: OK
          content:
            text/plain:
              example: |
                2021-04-20
                CVE-2021-3156
                CVE-2021-27065
                CVE-2021-26855
                CVE-2021-26411
                CVE-2021-21206
                CVE-2021-1732
                CVE-2021-1647
                CVE-2020-7961
                CVE-2020-3153
                CVE-2020-16040
                CVE-2020-1472
                CVE-2020-1054
                CVE-2020-1048
                CVE-2020-0796
                CVE-2019-7123
                CVE-2019-2725
                CVE-2019-1405
                CVE-2019-1132
                CVE-2019-0841
              schema:
                type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-cve-v1-latest
      description: Use the “latest” endpoint to retrieve results from the latest day for which we have data.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/cve/v1/latest' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/cve/v1/latest"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/cve/v1/all_cves:
    get:
      summary: TCF-0201 CVEs Exploited in the Wild (all)
      tags:
        - CVE and In-the-Wild Exploits
      responses:
        '200':
          description: OK
          content:
            text/plain:
              example: |
                2021-04-20
                CVE-2021-3156
                CVE-2021-27065
                CVE-2021-26855
                CVE-2021-26411
                CVE-2021-21206
                CVE-2021-1732
                CVE-2021-1647
                CVE-2020-7961
                CVE-2020-3153
                CVE-2020-16040
                CVE-2020-1472
                CVE-2020-1054
                CVE-2020-1048
                CVE-2020-0796
                CVE-2019-7123
                CVE-2019-2725
                CVE-2019-1405
                CVE-2019-1132
                CVE-2019-0841
              schema:
                type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-cve-v1-all_cves
      description: Use this query to fetch all CVE identifiers detected since the creation of this feed.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/cve/v1/all_cves' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/cve/v1/all_cves"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/report/cve/daily/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0202 Reports on CVEs Exploited in the Wild
      tags:
        - CVE and In-the-Wild Exploits
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      cve_daily_report:
                        type: object
                        properties:
                          time_range:
                            type: object
                            properties:
                              from:
                                type: string
                              to:
                                type: string
                            required:
                              - from
                              - to
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - cve_id
                                - total_count
                              properties:
                                cve_id:
                                  type: string
                                total_count:
                                  type: number
                                single_scan:
                                  type: object
                                  properties:
                                    count:
                                      type: number
                                    samples:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required:
                                          - sha256
                                          - sha1
                                          - md5
                                        properties:
                                          sha256:
                                            type: string
                                          sha1:
                                            type: string
                                          threat_names:
                                            type: array
                                            items:
                                              required: []
                                              properties: {}
                                          md5:
                                            type: string
                                  required:
                                    - count
                                    - samples
                                multiple_scan:
                                  type: object
                                  properties:
                                    count:
                                      type: number
                                    samples:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required:
                                          - sha256
                                          - sha1
                                          - md5
                                        properties:
                                          sha256:
                                            type: string
                                          sha1:
                                            type: string
                                          threat_names:
                                            type: array
                                            items:
                                              required: []
                                              properties: {}
                                          md5:
                                            type: string
                                  required:
                                    - count
                                    - samples
                        required:
                          - time_range
                          - entries
                    required:
                      - cve_daily_report
                required:
                  - rl
              example:
                rl:
                  cve_daily_report:
                    time_range:
                      from: '2024-12-31T00:00:00'
                      to: '2025-01-01T00:00:00'
                    entries:
                      - cve_id: CVE-2017-11882
                        total_count: 650
                        single_scan:
                          count: 66
                          samples:
                            - sha1: ae5056d01bad59bf92fb48124e69c9991811b79d
                              sha256: c9cf73192b0834aa26fd8161f66d0844284faf45aec64df5b0a5beec04556d58
                              md5: 6f68709b0add7e7acfb55b904f1fc670
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                            - sha1: 5aca5dfdf794db0860c178dc6e8c576b4c83a048
                              sha256: 055e4e5c4b246c2b4b65f0c4e065141113823a1c8d5f66a58b76746d4e0bf4ce
                              md5: 02f622b505aef2d55aa056f3ac4e0241
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                            - sha1: b6b9f4256257122dd1e2657ce8cca83a3c01bdc3
                              sha256: 1295c982df543367b8539c69ed8cb470134107bc2ed5f8a448e2f81ffdea9497
                              md5: f02ec3b10a1fb8a60f7d867436cee5c0
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                        multiple_scan:
                          count: 584
                          samples:
                            - sha1: 57de2610b06fd2fdb87a4a44f6d09387cb19f2bf
                              sha256: 3b0389cbb56df378a6c4f81297e4448351cab27d745f9803be2b5601154024af
                              md5: ef2b7eeb1bb2fb9cca5fc4120de45cd1
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                            - sha1: 9cdaa1355111a242d9eb1efb6edafac36ae35640
                              sha256: 3222b3759aa9a3f1f964df25a240858e32be313d64ed6666fd6ef85d250ce3f7
                              md5: fba031d299d90d3c30a88ce5bebc531f
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                            - sha1: 3ae638f0e7cc8efbe08d044967a7de2641758d38
                              sha256: 314f17df2acf73992301c239dc2223259ece9784687c182fc1629c8ffa2c2c8d
                              md5: d768261ef6b188a1b87bc2fbb6f48727
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-report-cve-daily-v1-query
      description: This query returns a document containing the list of malware hashes (SHA1, SHA256, MD5), threat names, and threat counts associated with CVE identifiers for the requested day.
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/report/cve/daily/v1/query/date/2025-01-01?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/report/cve/daily/v1/query/date/2025-01-01?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - name: time_format
        in: path
        required: true
        schema:
          type: string
          enum:
            - utc
            - date
          example: date
        description: Specifies the time format for the time_value parameter.
      - name: time_value
        in: path
        required: true
        schema:
          type: string
        description: Accepts values formatted according to the format set in the time_format parameter.
  /api/report/cve/daily/v1/query/latest:
    get:
      summary: TCF-0202 Reports on CVEs Exploited in the Wild (latest)
      tags:
        - CVE and In-the-Wild Exploits
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      cve_daily_report:
                        type: object
                        properties:
                          time_range:
                            type: object
                            properties:
                              from:
                                type: string
                              to:
                                type: string
                            required:
                              - from
                              - to
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - cve_id
                                - total_count
                              properties:
                                cve_id:
                                  type: string
                                total_count:
                                  type: number
                                single_scan:
                                  type: object
                                  properties:
                                    count:
                                      type: number
                                    samples:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required:
                                          - sha256
                                          - sha1
                                          - md5
                                        properties:
                                          sha256:
                                            type: string
                                          sha1:
                                            type: string
                                          threat_names:
                                            type: array
                                            items:
                                              required: []
                                              properties: {}
                                          md5:
                                            type: string
                                  required:
                                    - count
                                    - samples
                                multiple_scan:
                                  type: object
                                  properties:
                                    count:
                                      type: number
                                    samples:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required:
                                          - sha256
                                          - sha1
                                          - md5
                                        properties:
                                          sha256:
                                            type: string
                                          sha1:
                                            type: string
                                          threat_names:
                                            type: array
                                            items:
                                              required: []
                                              properties: {}
                                          md5:
                                            type: string
                                  required:
                                    - count
                                    - samples
                        required:
                          - time_range
                          - entries
                    required:
                      - cve_daily_report
                required:
                  - rl
              example:
                rl:
                  cve_daily_report:
                    time_range:
                      from: '2025-01-20T00:00:00'
                      to: '2025-01-21T00:00:00'
                    entries:
                      - cve_id: CVE-2017-11882
                        total_count: 920
                        single_scan:
                          count: 52
                          samples:
                            - sha1: 345837f462e89012359af4a26e25d8feac36292d
                              sha256: 2d86194d123a259e698f437402e6c082f894c4c29a68fafa171ec7cecbc89d84
                              md5: 2e5ffb0be1cf72532f1e451ebde10280
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                            - sha1: 65c5fb03ec98ac91e700dc34b5a00a23ce396171
                              sha256: e9fceea659b8ec951b23d21f7ddd29a200196473fe6d8b6b1289b323df37f46e
                              md5: 3b9bf26d63dda7e25708dec7648f7f62
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                            - sha1: 68fb47acc78ebf938967722c7dad9a2b6513f496
                              sha256: 252acb73b751d5b46090d9dc6aa48e3788e62a20df69e0ecfffc6587753602dc
                              md5: c7516e93168ab4bc922ade1dd3035ac5
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                        multiple_scan:
                          count: 868
                          samples:
                            - sha1: e715eda677506f721d583eda3832012a890a2e2d
                              sha256: 8828dc91f09f7886eafc470e64e4682da3435ca9c4e3f7db9805214157329a33
                              md5: 7dc786dd141689d65b38f3001c1c90e2
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                            - sha1: bedb3d7970864af8d857b03c1898e9e227a33534
                              sha256: f6898629e494cde1124483a71371fc735df9e2ea5731103d7837817fe4140a59
                              md5: 511ba30d95e7c70a0d3d89b7883cf5be
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
                            - sha1: c0618899407458dafa4945e42e27e14a81e9a27c
                              sha256: e3d7f8399cb3a4527bc6587580de827609e4ac7d4e63393859d71a4a661c41fd
                              md5: 698e43dd86147a28dd35fe5b78e64fae
                              threat_names:
                                - Document-Office.Exploit.CVE-2017-11882
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-report-cve-daily-v1-query-latest
      description: This query returns a document containing the list of malware hashes (SHA1, SHA256, MD5), threat names, and threat counts associated with CVE identifiers for the latest day for which we have data.
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/report/cve/daily/v1/query/latest?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/report/cve/daily/v1/query/latest?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/feed/malware/detection/exploit/hourly/v2/query/{time_format}/{time_value}:
    get:
      summary: TCF-0203 New Exploit or CVE Samples Found In-the-Wild (Hourly List)
      tags:
        - CVE and In-the-Wild Exploits
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - scanner_count
                                - first_seen_on
                                - cve_id
                                - scanner_percent
                                - md5
                                - sha1
                                - record_on
                                - scanner_match
                                - last_seen_on
                                - sample_type
                                - active_cve
                                - sha256
                              properties:
                                scanner_count:
                                  type: string
                                first_seen_on:
                                  type: string
                                cve_id:
                                  type: string
                                scanner_percent:
                                  type: string
                                md5:
                                  type: string
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                scanner_match:
                                  type: string
                                last_seen_on:
                                  type: string
                                sample_type:
                                  type: string
                                active_cve:
                                  type: string
                                sha256:
                                  type: string
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - name
                          - time_range
                    required:
                      - feed
                required:
                  - rl
              example:
                rl:
                  feed:
                    entries:
                      - scanner_count: '38'
                        first_seen_on: '1735690435013'
                        cve_id: CVE-2017-11882
                        scanner_percent: '78.9473648071'
                        md5: bd506ef453ce35891b6f376a4a57067d
                        sha1: ea00a2bb60f988dfb4a331f338ff0864b43a50c3
                        record_on: '2025-01-01T00:32:31'
                        scanner_match: '30'
                        last_seen_on: '1735691460000'
                        sample_type: PDF document, version 1.1, 0 pages
                        active_cve: 'True'
                        sha256: 494a6795c90db8c30fc973afba936711f71804d0d9a4cb4dca3c9472b285a4de
                    name: hourly_malware_detection_exploit_feed
                    time_range:
                      to: '2025-01-01T00:59:59'
                      from: '2025-01-01T00:00:00'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-detection-exploit-hourly-v2-query
      parameters:
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/ActiveCVE'
      description: This service provides a list of new file hashes that contain CVE or Exploit Identification and that are detected within the requested one-hour period in the Spectra Intelligence system.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/detection/exploit/hourly/v2/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/detection/exploit/hourly/v2/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/detection/exploit/hourly/v2/query/latest:
    get:
      summary: TCF-0203 New Exploit or CVE Samples Found In-the-Wild (Hourly List) - latest
      tags:
        - CVE and In-the-Wild Exploits
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - scanner_count
                                - first_seen_on
                                - cve_id
                                - scanner_percent
                                - md5
                                - sha1
                                - record_on
                                - scanner_match
                                - last_seen_on
                                - sample_type
                                - active_cve
                                - sha256
                              properties:
                                scanner_count:
                                  type: string
                                first_seen_on:
                                  type: string
                                cve_id:
                                  type: string
                                scanner_percent:
                                  type: string
                                md5:
                                  type: string
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                scanner_match:
                                  type: string
                                last_seen_on:
                                  type: string
                                sample_type:
                                  type: string
                                active_cve:
                                  type: string
                                sha256:
                                  type: string
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - name
                          - time_range
                    required:
                      - feed
                required:
                  - rl
              example:
                rl:
                  feed:
                    entries:
                      - scanner_count: '24'
                        first_seen_on: '1612867440000'
                        cve_id: CVE-2009-1185
                        scanner_percent: '37.5'
                        md5: 268372a69e7fd058cb88cdfa0c28998b
                        sha1: 75fee53fadc8338a5aa411d64113c3bf611960e5
                        record_on: '2025-01-21T09:15:00'
                        scanner_match: '9'
                        last_seen_on: '1737450780000'
                        sample_type: 'gzip compressed data, was 1069-ffd7647d3ebec7640eeedc0b6d6b2c016a212f47, last modified: Fri Feb 5 09:27:11 2021, max compression, from Unix, original size modulo 2^32 1249280'
                        active_cve: 'True'
                        sha256: 476bac3c342a3609b0534a491c30e0030b3f245b8eae7b4234660e3376e149df
                      - scanner_count: '38'
                        first_seen_on: '1737450077832'
                        cve_id: CVE-2017-0199
                        scanner_percent: '15.7894735336'
                        md5: a927e891663035514f6827a11ec5c9f9
                        sha1: d69db99bdce7383367326db5ae254108f3dca0af
                        record_on: '2025-01-21T09:07:26'
                        scanner_match: '6'
                        last_seen_on: '1737450420000'
                        sample_type: 'OLE 2 Compound Document, v3.33, SecID 0x1a, Mini FAT start sector 0x19 : Microsoft Word 97-2003 document or template'
                        active_cve: 'True'
                        sha256: 3cd74463fe757e4b565b4c1da55de8f44f090a181609a7dd344c212f1dee8bdd
                      - scanner_count: '38'
                        first_seen_on: '1737450280060'
                        cve_id: CVE-2017-11882
                        scanner_percent: '52.6315803528'
                        md5: 6eccce555f4e86a1c321adb7b4dfb6f5
                        sha1: c3f915af8c616118e84cb4b48b94b7b63a71ce78
                        record_on: '2025-01-21T09:14:00'
                        scanner_match: '20'
                        last_seen_on: '1737450780000'
                        sample_type: gzip compressed data, max compression, from Unix, original size modulo 2^32 53296
                        active_cve: 'True'
                        sha256: 56e5c0ccb26d2631bbc3144c085a7ba5a7d7bfaf0d3717866246fe43e33105f6
                      - scanner_count: '38'
                        first_seen_on: '1737449987668'
                        cve_id: CVE-2010-1885
                        scanner_percent: '23.6842098236'
                        md5: 78c9ffddb2bef2a613ca78f5340f495b
                        sha1: 7737f5d46be3c4b0a8edeb0d1f8da2f168451159
                        record_on: '2025-01-21T09:18:33'
                        scanner_match: '9'
                        last_seen_on: '1737451080000'
                        sample_type: HTML document, Unicode text, UTF-16, little-endian text, with very long lines (2351), with CRLF line terminators
                        active_cve: 'True'
                        sha256: 6457449be3ee6724338a8219b1a366f2a90506f8ba9433c70276fdb4274d5357
                      - scanner_count: '38'
                        first_seen_on: '1737450054882'
                        cve_id: CVE-2010-1885
                        scanner_percent: '36.8421058655'
                        md5: 0c89005a7187843860db81e1e8cc8a87
                        sha1: 5263ae521ce8e3b96a155a1e38092a095298ad8e
                        record_on: '2025-01-21T09:12:05'
                        scanner_match: '14'
                        last_seen_on: '1737450660000'
                        sample_type: HTML document, Unicode text, UTF-16, little-endian text, with very long lines (1976), with CRLF line terminators
                        active_cve: 'True'
                        sha256: c023246af097c0854c7ed95be78da83b5712d913b2033082db3d6418f9a3dd4f
                    name: hourly_malware_detection_exploit_feed
                    time_range:
                      to: '2025-01-21T09:59:59'
                      from: '2025-01-21T09:00:00'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-detection-exploit-hourly-v2-query-latest
      description: This query returns the results from the latest hour for which we have data.
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/ActiveCVE'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/detection/exploit/hourly/v2/query/latest?format=json&sample_available=true' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/detection/exploit/hourly/v2/query/latest?format=json&sample_available=true"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/feed/malware/exploit/daily/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0204 New Exploit and CVE Samples Found In-the-Wild (Daily List)
      tags:
        - CVE and In-the-Wild Exploits
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha256
                                - sha1
                                - sample_type
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                sample_type:
                                  type: string
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - name
                          - time_range
                    required:
                      - feed
                required:
                  - rl
              example:
                rl:
                  feed:
                    entries:
                      - sha256: 78b7164d838a4ef7adcad527306ab359c8c024197f52a8a6db33576bb4aaa23b
                        sha1: 842257e86a19bddae17e1da56c7408ffdaec7b7e
                        sample_type: PDF document, version 1.1, 0 pages
                      - sha256: 374bae6a22e381008f3e6ceea575c83b82ec7baea44a4223b2bb5d3ee0e6a96e
                        sha1: 8040445c5fbec9bfeddeb01286184626bab2ea9e
                        sample_type: PDF document, version 1.1, 0 pages
                      - sha256: 82c3a87ca4f6238d0e209b90f79d19aedaaf206883b9e77e1aa3b6949d15ea1b
                        sha1: 19d7367427508d6ca896f5d12bdee320bc6c7204
                        sample_type: PDF document, version 1.1, 0 pages
                    name: malware/exploit/daily/v1
                    time_range:
                      to: '2025-01-01T23:59:59'
                      from: '2025-01-01T00:00:00'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-exploit-daily-v1-query
      description: This service provides per-day information about new file hashes in the Spectra Intelligence system that contain CVE or Exploit identifications.
      parameters:
        - $ref: '#/components/parameters/SampleAvailable'
        - schema:
            type: string
            enum:
              - xml
              - json
              - htsv
            default: xml
          in: query
          name: format
          description: 'Specifies the format in which the resulting data will be returned. '
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/exploit/daily/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/exploit/daily/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - name: time_format
        in: path
        required: true
        schema:
          type: string
          enum:
            - utc
            - date
          example: date
        description: Specifies the time format for the time_value parameter.
      - name: time_value
        in: path
        required: true
        schema:
          type: string
        description: Accepts values formatted according to the format set in the time_format parameter.
  /api/feed/malware/exploit/daily/v1/query/latest:
    get:
      summary: TCF-0204 New Exploit and CVE Samples Found In-the-Wild (Daily List) - latest
      tags:
        - CVE and In-the-Wild Exploits
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha256
                                - sha1
                                - sample_type
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                sample_type:
                                  type: string
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - name
                          - time_range
                    required:
                      - feed
                required:
                  - rl
              example:
                rl:
                  feed:
                    entries:
                      - sha256: ca5856bb35d19cbd2a3ad4f93da1e3ffcd83470beb7fce236a5f37f68ff979cc
                        sha1: 6f0763284e08a3b20aeee16964c64c33fcd5a0fc
                        sample_type: HTML document, Unicode text, UTF-8 text, with very long lines (8047), with CRLF, LF line terminators
                      - sha256: 2650e22bb818ae1693d5660a1d83c6a9389890620c45079e57d4c8f7ec593978
                        sha1: d1a88f0b1499b7ef0072bc70701795a1c252bb5d
                        sample_type: HTML document, Unicode text, UTF-8 text, with very long lines (8047), with CRLF, LF line terminators
                      - sha256: 9b07dc57125875afe2a775a8b82d5e0855c3b5cdf796396a53cb07a235cdbc42
                        sha1: 3d3d58929cbf7d81d37d542a81fedafb736777e6
                        sample_type: HTML document, Unicode text, UTF-8 text, with very long lines (8047), with CRLF, LF line terminators
                    name: malware/exploit/daily/v1
                    time_range:
                      to: '2025-01-20T23:59:59'
                      from: '2025-01-20T00:00:00'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-exploit-daily-v1-query-latest
      description: Use the “latest” endpoint to retrieve results from the latest day for which we have data.
      parameters:
        - $ref: '#/components/parameters/SampleAvailable'
        - schema:
            type: string
            enum:
              - xml
              - json
              - htsv
            default: xml
            example: json
          in: query
          description: 'Specifies the format in which the resulting data will be returned. '
          name: format
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/exploit/daily/v1/query/latest?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/exploit/daily/v1/query/latest?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/feed/malware_uri/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0301 Network IOCs Feed
      tags:
        - Network Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      malware_uri_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - record_on
                                - uri
                                - uri_type
                              properties:
                                record_on:
                                  type: string
                                uri:
                                  type: string
                                samples:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - threat_name
                                      - sha1
                                      - sha256
                                    properties:
                                      threat_name:
                                        type: string
                                      sha1:
                                        type: string
                                      sha256:
                                        type: string
                                uri_type:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - malware_uri_feed
                required:
                  - rl
              example:
                rl:
                  malware_uri_feed:
                    entries:
                      - record_on: '2025-01-01T00:00:05'
                        uri_type: url
                        uri: http://6h.ialeahed.com/AG5qBpI1E1Ui7ALrtj3f1JznemsGa8Qx8s/
                        threat_level: 5
                        samples:
                          - sha1: aa85c30885cc575089c6fe98a5efde321b88fa1a
                            threat_name: Document-HTML.Phishing.Acsogenixx
                      - record_on: '2025-01-01T00:00:05'
                        uri_type: url
                        uri: https://6h.ialeahed.com/AG5qBpI1E1Ui7ALrtj3f1JznemsGa8Qx8s/
                        threat_level: 5
                        samples:
                          - sha1: aa85c30885cc575089c6fe98a5efde321b88fa1a
                            threat_name: Document-HTML.Phishing.Acsogenixx
                      - record_on: '2025-01-01T00:00:05'
                        uri_type: url
                        uri: https://danfra.com/la-chucara-124/
                        threat_level: 5
                        samples:
                          - sha1: 70639988c886836bd5709e1cd8634b3692f7e7c2
                            threat_name: Document-HTML.Phishing.Generic
                    last_timestamp: '2025-01-01T00:06:03'
                    time_range:
                      from: '2025-01-01T00:00:00'
                      to: '2025-01-01T00:06:03'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware_uri-v1-query
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
      description: Returns information about malicious URLs from 3rd party sources and  URLs from which we have downloaded malicious files.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware_uri/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware_uri/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware_uri/v1/query/latest:
    get:
      summary: TCF-0301 Network IOCs Feed (latest)
      tags:
        - Network Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      malware_uri_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - record_on
                                - uri
                                - uri_type
                              properties:
                                record_on:
                                  type: string
                                uri:
                                  type: string
                                samples:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - threat_name
                                      - sha1
                                      - sha256
                                    properties:
                                      threat_name:
                                        type: string
                                      sha1:
                                        type: string
                                      sha256:
                                        type: string
                                uri_type:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - malware_uri_feed
                required:
                  - rl
              example:
                rl:
                  malware_uri_feed:
                    entries:
                      - record_on: '2025-01-21T10:04:01'
                        uri_type: url
                        uri: https://audioz.uproxy2.biz/tutorials/books/sound_magazines/34883-download_gramophone-december-2011-uk.html
                        threat_level: 2
                        samples:
                          - sha1: fe12db00a2c1af27087e6f2a9048641104eaeee1
                            threat_name: Document-HTML.Trojan.Heuristic
                      - record_on: '2025-01-21T10:04:01'
                        uri_type: url
                        uri: https://tokybook.unblocked2.icu/search/Sin+/page/432
                        threat_level: 2
                        samples:
                          - sha1: b456eb0df9524655804978f9e623f2e2be66248d
                            threat_name: Document-HTML.Trojan.Heuristic
                      - record_on: '2025-01-21T10:04:01'
                        uri_type: url
                        uri: https://audioz.mega123proxy.com/samples/65560-download_villem-samples-and-sound-design-drum-and-bass-sample-pack-vol1-wav-magnetrixx.html
                        threat_level: 2
                        samples:
                          - sha1: 7f70b012d52ab1dbf3420764ed7d2f75ee0c7216
                            threat_name: Document-HTML.Trojan.Heuristic
                    last_timestamp: 1737453892
                    time_range:
                      from: '2025-01-21T10:04:01'
                      to: '2025-01-21T10:04:52'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware_uri-v1-query-latest
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
      description: Returns information about malicious URLs from 3rd party sources and  URLs from which we have downloaded malicious files.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware_uri/v1/query/latest?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware_uri/v1/query/latest?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/feed/cf/malware_uri/v1/query/start/{time_format}/{time_value}:
    put:
      summary: TCF-0301 Network IOCs Feed (Start)
      operationId: put-api-feed-cf-malware-uri-v1-query-start
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      tags:
        - Network Indicators
      description: This query sets the starting timestamp for the `pull` query.
      x-codeSamples:
        - lang: bash
          source: |
            curl --location --request PUT 'https://data.reversinglabs.com/api/feed/cf/malware_uri/v1/query/start/utc/2025-01-01T00:00:00' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware_uri/v1/query/start/utc/2025-01-01T00:00:00"
            response = requests.put(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/cf/malware_uri/v1/query/pull:
    get:
      summary: TCF-0301 Network IOCs Feed (Pull)
      tags:
        - Network Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    required:
                      - malware_uri_feed
                    properties:
                      malware_uri_feed:
                        type: object
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - record_on
                                - uri
                                - uri_type
                                - threat_level
                              properties:
                                record_on:
                                  type: string
                                uri:
                                  type: string
                                uri_type:
                                  type: string
                                threat_level:
                                  type: integer
                                samples:
                                  type: array
                                  uniqueItems: true
                                  minItems: 1
                                  items:
                                    required:
                                      - threat_name
                                      - sha1
                                    properties:
                                      threat_name:
                                        type: string
                                      sha1:
                                        type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            required:
                              - to
                              - from
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                required:
                  - rl
              example:
                rl:
                  malware_uri_feed:
                    time_range:
                      from: '2025-11-13T08:27:56'
                      to: '2025-11-13T09:03:52'
                    entries:
                      - record_on: '2025-11-13T08:28:08'
                        uri_type: url
                        uri: https://amazon-suivi.comngyxjfmqykm1q3wu.amazon-suivi.com/
                        threat_level: 5
                      - record_on: '2025-11-13T08:28:48'
                        uri_type: url
                        uri: https://ikomsolutions.com/admin/userfiles/file/wegapuw.pdf
                        threat_level: 2
                        samples:
                          - sha1: 7d10511b961b363a36ad05adaaa2fe11056cb5f7
                            threat_name: Document-PDF.Trojan.Heuristic
                    last_timestamp: 1763024632
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-cf-malware-uri-v1-query-pull
      description: This query returns a list of malicious URIs that have been detected in the Spectra Intelligence system, starting with the timestamp defined with the `start` query.
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - $ref: '#/components/parameters/Limit'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/cf/malware_uri/v1/query/pull?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/cf/malware_uri/v1/query/pull?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
  /api/feed/malware/detection/family/v2/query/{category}/{time_format}/{time_value}:
    get:
      summary: TCF-0401-0406 (time range)
      tags:
        - Targeted and Industry-Specific Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              from:
                                type: number
                              to:
                                type: number
                            required:
                              - from
                              - to
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - record_on
                                - sha1
                                - priority
                                - family_name
                                - sample_available
                                - container_hash
                                - sha256
                                - md5
                                - sample_size
                                - sample_type
                                - first_seen_on
                                - last_seen_on
                              properties:
                                record_on:
                                  type: number
                                sha1:
                                  type: string
                                priority:
                                  type: number
                                family_name:
                                  type: string
                                sample_available:
                                  type: boolean
                                container_hash:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                                sample_size:
                                  type: number
                                sample_type:
                                  type: string
                                first_seen_on:
                                  type: number
                                last_seen_on:
                                  type: number
                                cvssv3:
                                  type: object
                                  properties:
                                    attack_vector:
                                      type: string
                                    integrity_impact:
                                      type: string
                                    attack_complexity:
                                      type: string
                                    cvssv3_base_score:
                                      type: number
                                    availability_impact:
                                      type: string
                                    confidentiality_impact:
                                      type: string
                                  required:
                                    - attack_vector
                                    - integrity_impact
                                    - attack_complexity
                                    - cvssv3_base_score
                                    - availability_impact
                                    - confidentiality_impact
                                tags:
                                  type: object
                                  properties:
                                    versions:
                                      type: array
                                      items:
                                        required: []
                                        properties: {}
                                    affects:
                                      type: array
                                      items:
                                        required: []
                                        properties: {}
                                    actors:
                                      type: array
                                      items:
                                        required: []
                                        properties: {}
                                  required:
                                    - versions
                                    - affects
                                    - actors
                          category:
                            type: string
                        required:
                          - name
                          - time_range
                          - entries
                          - category
                    required:
                      - feed
                required:
                  - rl
              example:
                rl:
                  feed:
                    name: Malware Detection Family Feed
                    time_range:
                      from: 1735689600
                      to: 1735689629
                    entries:
                      - record_on: 1735689604
                        sha1: 1055c6991309f5de3c0681026c1be11c6535f9d5
                        priority: 5
                        family_name: CobaltStrike
                        sample_available: true
                        container_hash: 1055c6991309f5de3c0681026c1be11c6535f9d5
                        sha256: 5f71a6a1e1a4d91373db6aa752c3c25dc14b547344e2d79d0d5eb9a15231e794
                        md5: eff68b6302cfec815b5277586c24e722
                        sample_size: 465551
                        sample_type: PE/Exe/dxPack
                        first_seen_on: 1735689206
                        last_seen_on: 1735689573
                      - record_on: 1735689604
                        sha1: 124491b15d69e5e80d086e5270012a569ed4ceba
                        priority: 5
                        family_name: CobaltStrike
                        sample_available: true
                        container_hash: 124491b15d69e5e80d086e5270012a569ed4ceba
                        sha256: cad8fdee80caf1ec1cb58cc6cc47c2dd77c90e515ad46239a242cfe6cf07fc2d
                        md5: 9a9a8009df624f3065398bbc096e0826
                        sample_size: 465219
                        sample_type: PE/Exe/dxPack
                        first_seen_on: 1735689170
                        last_seen_on: 1735689574
                      - record_on: 1735689604
                        sha1: c32ebfa591f28940e5cdac012a4508fbf8a94d42
                        priority: 5
                        family_name: CobaltStrike
                        sample_available: true
                        container_hash: c32ebfa591f28940e5cdac012a4508fbf8a94d42
                        sha256: 9a47137b7721cbc192c840446e1d70806bc9b38e45d3beb63541c0055560f196
                        md5: 377b0d2b8b8b993b30bd90781effb602
                        sample_size: 465190
                        sample_type: PE/Exe/dxPack
                        first_seen_on: 1735689170
                        last_seen_on: 1735689574
                    category: APT
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-detection-family-v2-query
      description: ReversingLabs Targeted and Industry-Specific Indicators are early-warning feeds that provide information about new malware samples detected in the ReversingLabs Spectra Intelligence system. The samples are filtered by category. Every category corresponds to one feed. The feeds are specialized collections of malware families that are known to have significant impact within specific industries (Retail, Financial), as well as of malware families that share a common trait (exploits, ransomware). ReversingLabs carefully selects malware families for each feed based on public and internal research. The feed stores records for the last 365 days.
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - schema:
            type: number
            default: 100
            minimum: 1
            maximum: 1000
          in: query
          name: count
          description: Allows specifying how many of the latest hashes in the selected category should be returned in the response.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/detection/family/v2/query/apt/utc/2025-01-01T00:00:00?format=json&count=200' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/detection/family/v2/query/apt/utc/2025-01-01T00:00:00?format=json&count=200"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/Categories'
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/malware/detection/family/v2/query/{category}/latest:
    get:
      summary: TCF-0401-0406 (latest)
      tags:
        - Targeted and Industry-Specific Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      feed:
                        type: object
                        properties:
                          name:
                            type: string
                          time_range:
                            type: object
                            properties:
                              from:
                                type: number
                              to:
                                type: number
                            required:
                              - from
                              - to
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - record_on
                                - sha1
                                - priority
                                - family_name
                                - sample_available
                                - container_hash
                                - sha256
                                - md5
                                - sample_size
                                - sample_type
                                - first_seen_on
                                - last_seen_on
                              properties:
                                record_on:
                                  type: number
                                sha1:
                                  type: string
                                priority:
                                  type: number
                                family_name:
                                  type: string
                                sample_available:
                                  type: boolean
                                container_hash:
                                  type: string
                                sha256:
                                  type: string
                                md5:
                                  type: string
                                sample_size:
                                  type: number
                                sample_type:
                                  type: string
                                first_seen_on:
                                  type: number
                                last_seen_on:
                                  type: number
                                cvssv3:
                                  type: object
                                  properties:
                                    attack_vector:
                                      type: string
                                    integrity_impact:
                                      type: string
                                    attack_complexity:
                                      type: string
                                    cvssv3_base_score:
                                      type: number
                                    availability_impact:
                                      type: string
                                    confidentiality_impact:
                                      type: string
                                  required:
                                    - attack_vector
                                    - integrity_impact
                                    - attack_complexity
                                    - cvssv3_base_score
                                    - availability_impact
                                    - confidentiality_impact
                                tags:
                                  type: object
                                  properties:
                                    versions:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required: []
                                        properties: {}
                                    affects:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required: []
                                        properties: {}
                                    actors:
                                      type: array
                                      uniqueItems: true
                                      minItems: 1
                                      items:
                                        required: []
                                        properties: {}
                                  required:
                                    - versions
                                    - affects
                                    - actors
                          category:
                            type: string
                        required:
                          - name
                          - time_range
                          - entries
                          - category
                    required:
                      - feed
                required:
                  - rl
              example:
                rl:
                  feed:
                    name: Malware Detection Family Feed
                    time_range:
                      from: 1737442635
                      to: 1737454050
                    entries:
                      - record_on: 1737453981
                        sha1: 038baacdc4260a0c96bb35760aef6f496d007984
                        priority: 5
                        family_name: Upater
                        sample_available: true
                        container_hash: 038baacdc4260a0c96bb35760aef6f496d007984
                        sha256: d8a11db51b76b4bf25fcfef3818be4c4a42b0c9ef5f8e46ed3cd3688f621a05e
                        md5: 4ba4339b55bbce2f57eac33c806bf2cf
                        sample_size: 51627
                        sample_type: PE/Exe/cpTinyGiant
                        first_seen_on: 1737448080
                        last_seen_on: 1737453931
                        bot_configs:
                          botFamily: Upater
                          botServer: spinistry.com/wp-share/7eve.exe
                      - record_on: 1737453501
                        sha1: e58ac0e502dd3806cee0469db5317837245edfb1
                        priority: 5
                        family_name: Remcos
                        sample_available: true
                        container_hash: 226372a23040929e93444dbb454908bc20f13598
                        sha256: 733cb63fef205c4bc57f7f6e8bbcd155ae5a632d023babd569ae43eda6ce2378
                        md5: 18710736825a8fcc5dd2900cfc3ab389
                        sample_size: 475136
                        sample_type: PE/Exe
                        first_seen_on: 1737452002
                        last_seen_on: 1737453456
                        bot_configs:
                          botFamily: Remcos
                          botServer: lazerfusion.hopto.org
                          botRunMutex: gfhgdfasdfg978r6edtfyy8ugj-5H297K
                          botInstallationPath: Application path
                          botFileName: remcos.exe
                          botPassword: '1'
                      - record_on: 1737452586
                        sha1: 183a00886b0666cb63a20881d834b3cf9e49b6c5
                        priority: 5
                        family_name: Upater
                        sample_available: true
                        container_hash: 183a00886b0666cb63a20881d834b3cf9e49b6c5
                        sha256: cec04cb651786d1bdb61f919038273399211ef2f57590dc1da175c7db68b6c72
                        md5: eb5f6ec8ec89ff08841add41b0612eb5
                        sample_size: 54262
                        sample_type: PE/Exe/cpTinyGiant
                        first_seen_on: 1737450949
                        last_seen_on: 1737452570
                        bot_configs:
                          botFamily: Upater
                          botServer: spinistry.com/wp-share/7eve.exe
                    category: CONFIGURATION
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-malware-detection-family-v2-query-latest
      description: ReversingLabs Targeted and Industry-Specific Indicators are early-warning feeds that provide information about new malware samples detected in the ReversingLabs Spectra Intelligence system. The samples are filtered by category. Every category corresponds to one feed. The feeds are specialized collections of malware families that are known to have significant impact within specific industries (Retail, Financial), as well as of malware families that share a common trait (exploits, ransomware). ReversingLabs carefully selects malware families for each feed based on public and internal research. The feed stores records for the last 365 days.
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - schema:
            type: number
            default: 100
            minimum: 1
            maximum: 1000
          in: query
          name: count
          description: Allows specifying how many of the latest hashes in the selected category should be returned in the response.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/malware/detection/family/v2/query/apt/latest?format=json&count=200' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/malware/detection/family/v2/query/apt/utc/2025-01-01T00:00:00?format=json&count=200"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - name: category
        in: path
        required: true
        schema:
          type: string
          enum:
            - apt
            - financial
            - ransomware
            - retail
            - exploit
            - configuration
          example: apt
        description: |-
          - TCF-0401: Advanced Persistent Threats (APT)
          - TCF-0402: Financial Services Malware       
          - TCF-0403: Ransomware                       
          - TCF-0404: Retail Sector Malware            
          - TCF-0405: CVE Exploits                     
          - TCF-0406: Malware Configuration            
  /api/feed/whitelisted/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0501 Whitelisted Files - New
      tags:
        - Whitelist File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      whitelisted_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha256
                                - sha1
                                - record_on
                                - platform
                                - md5
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                platform:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - whitelisted_feed
                required:
                  - rl
              example:
                rl:
                  whitelisted_feed:
                    time_range:
                      from: '2025-01-01T00:00:00'
                      to: '2025-01-01T00:00:54'
                    entries:
                      - sha1: 010475de05083499201b62763da4fe9c17487836
                        md5: 12370a49c4f6fa8e37ac28a6fee809ac
                        sha256: 75752cf0057aa6d72ee5791d2b7d7cc6f65777b140035e7facb904d4141cc1fb
                        platform: Script
                        record_on: '2025-01-01T00:00:04'
                      - sha1: 018a1d1089ebd7aa233a4fdf27327589bd60c72a
                        md5: 3c70fc61f1635b224ba29137bfc9317c
                        sha256: 0da4354c9a35038ca94b80162b3315152d4527a9dc3fd641639149cc0189ca77
                        platform: Script
                        record_on: '2025-01-01T00:00:04'
                      - sha1: 02513f6fd3ebf3cf90c6a0d9eff7e4493a349d84
                        md5: 75fdad04d15aba7be9de53fb1ce05cbe
                        sha256: 98716f622e4f051f77be3863acde91495098fdb18a9b45705216e125492e5584
                        platform: Script
                        record_on: '2025-01-01T00:00:04'
                    last_timestamp: '2025-01-01T00:00:54'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-whitelisted-v1-query
      description: This query returns a list of newly whitelisted samples since the requested time.
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/whitelisted/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/whitelisted/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/whitelisted/v1/query/start/{time_format}/{time_value}:
    put:
      summary: TCF-0501 Whitelisted Files - New (Start)
      operationId: put-api-feed-whitelisted-v1-query-start
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      description: This query sets the starting timestamp for the `pull` query.
      tags:
        - Whitelist File Indicators
      x-codeSamples:
        - lang: bash
          source: |
            curl --location --request PUT 'https://data.reversinglabs.com/api/feed/whitelisted/v1/query/start/utc/2025-01-01T00:00:00' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/whitelisted/v1/query/start/utc/2025-01-01T00:00:00"
            response = requests.put(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/whitelisted/v1/query/pull:
    get:
      summary: TCF-0501 Whitelisted Files - New (Pull)
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      whitelisted_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha256
                                - sha1
                                - record_on
                                - platform
                                - md5
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                platform:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - whitelisted_feed
                required:
                  - rl
              example:
                rl:
                  whitelisted_feed:
                    time_range:
                      from: '2024-01-22T10:59:54'
                      to: '2024-01-22T11:00:57'
                    entries:
                      - sha1: 03791a63832dc307c3c0cd52e85b68274a389bd4
                        md5: 4af35c7f17d94fc16b4a0d7599f15126
                        sha256: b085fcbf9242a8ec757e97901e5e7df836262572744d1c7be7b238b8b22df11e
                        platform: Script
                        record_on: '2024-01-22T10:59:56'
                      - sha1: 047a1d6b1ca6362bcea7676d20fd96c0076a1dfd
                        md5: c49a274414269557fa3c9609f2572d26
                        sha256: fb60292a75707ada495cfbf57457be15adf5f07a1fe8209295fde4f2ce199b9a
                        platform: Script
                        record_on: '2024-01-22T10:59:56'
                      - sha1: 09498825e492ffa03cb1a64e8396294427116924
                        md5: d3a0305c59be6bb3a2c3e2548b5f66c5
                        sha256: 2e79862cd07ae32c351762e466b114fbbf34002eb8697e5cf2eae50c74a791cd
                        platform: Script
                        record_on: '2024-01-22T10:59:56'
                    last_timestamp: 1705921257
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-whitelisted-v1-query-pull
      description: This query returns a list of newly whitelisted samples, starting with the timestamp defined with the `start` query.
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
        - $ref: '#/components/parameters/SampleAvailable'
        - $ref: '#/components/parameters/Limit'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/whitelisted/v1/query/pull?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/whitelisted/v1/query/pull?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
      tags:
        - Whitelist File Indicators
  /api/feed/whitelisted_change/v1/query/{time_format}/{time_value}:
    get:
      summary: TCF-0502 Whitelisted Files - Changes
      tags:
        - Whitelist File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      whitelisted_change_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha256
                                - sha1
                                - record_on
                                - platform
                                - md5
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                platform:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - whitelisted_change_feed
                required:
                  - rl
              example:
                rl:
                  whitelisted_change_feed:
                    time_range:
                      from: '2025-01-01T00:00:00'
                      to: '2025-01-12T09:29:20'
                    entries:
                      - sha1: 1897524ee9f06a88334d4bb0eb94111033babf79
                        md5: 3c4f6e47711c330516b16ee72a5e4674
                        sha256: bd12b1d0d74f8279e5ad5c7eb9c762edf2f29df12f9613604e9f07ea964170f7
                        platform: Windows
                        record_on: '2025-01-01T02:29:45'
                      - sha1: 1a6ac43e24d7be2507ceb1545cc4b090c54e1638
                        md5: dbae69b495a466334f9185ed85aaec2d
                        sha256: ff8890de52a541caae68b8d24009324ba5b5d8f3ba9adfa90f83f951583b62a3
                        platform: Windows
                        record_on: '2025-01-01T02:29:46'
                      - sha1: 9f414956fe0d81ba0c79a96ea977532e57482a4c
                        md5: d87e6e6b0efe26931d7ed45d6cd7f2ec
                        sha256: 33af65233cb8869634611019e71ab51c7c92a2d7d885bc3c73c3d1d823fca53d
                        platform: Android
                        record_on: '2025-01-01T03:14:27'
                    last_timestamp: '2025-01-12T09:29:20'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-whitelisted_change-v1-query
      description: This query returns the samples which changed their whitelist status since the requested time.
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/whitelisted_change/v1/query/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/whitelisted_change/v1/query/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - $ref: '#/components/parameters/TimeFormat'
      - $ref: '#/components/parameters/TimeValue'
  /api/feed/whitelisted_change/v1/query/latest:
    get:
      summary: TCF-0502 Whitelisted Files - Changes (latest)
      tags:
        - Whitelist File Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                description: ''
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      whitelisted_change_feed:
                        type: object
                        properties:
                          entries:
                            type: array
                            uniqueItems: true
                            minItems: 1
                            items:
                              required:
                                - sha256
                                - sha1
                                - record_on
                                - platform
                                - md5
                              properties:
                                sha256:
                                  type: string
                                sha1:
                                  type: string
                                record_on:
                                  type: string
                                platform:
                                  type: string
                                md5:
                                  type: string
                          last_timestamp:
                            type: string
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                              from:
                                type: string
                            required:
                              - to
                              - from
                        required:
                          - entries
                          - last_timestamp
                          - time_range
                    required:
                      - whitelisted_change_feed
                required:
                  - rl
              example:
                rl:
                  whitelisted_change_feed:
                    time_range:
                      from: '2025-01-21T10:19:02'
                      to: '2025-01-21T10:23:53'
                    entries:
                      - sha1: 2ab763f8a95a2eff2809abc5b8320e4047ab9d6b
                        md5: 174bf6f38c63f5a0554fc58b8791634b
                        sha256: eaeeb923ab4616ff547a464106182ae1a9cb9516b0cc19c56598d88df022c906
                        platform: Script
                        record_on: '2025-01-21T10:19:02'
                      - sha1: 13d46f34ea97cd63d977e2a5d29614d58182de2c
                        md5: e048213df4dabee4d1d3796ffb2f5f19
                        sha256: c52446354c6c3f73656fea15951e2f36acac0c266de46153f68a6309ec7e872b
                        platform: Windows
                        record_on: '2025-01-21T10:23:53'
                    last_timestamp: 1737455033
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-whitelisted_change-v1-query-latest
      description: This query returns the 1000 latest samples which changed their whitelist status.
      parameters:
        - $ref: '#/components/parameters/ResponseTSV'
    parameters: []
  /api/feed/certificate/v1/query/from/{time_format}/{time_value}:
    get:
      summary: TCF-0601 Certificate Feed API (time range)
      tags:
        - Certificate Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      certificate_feed:
                        type: array
                        items:
                          type: object
                          properties:
                            container_sha1:
                              type: string
                            signatures:
                              type: object
                              properties:
                                counter_signatures:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      counter_signatures:
                                        type: 'null'
                                      certificate:
                                        type: object
                                        properties:
                                          valid_from:
                                            type: string
                                          signature_algorithm:
                                            type: string
                                          valid_to:
                                            type: string
                                          version:
                                            type: string
                                          extensions:
                                            type: array
                                            items:
                                              type: object
                                              properties:
                                                is_critical:
                                                  type: string
                                                name:
                                                  type: string
                                                value:
                                                  type: string
                                          signature:
                                            type: string
                                          common_name:
                                            type: string
                                          serial_number:
                                            type: string
                                          certificate_thumbprints:
                                            type: array
                                            items:
                                              type: object
                                              properties:
                                                name:
                                                  type: string
                                                value:
                                                  type: string
                                          issuer:
                                            type: object
                                            properties:
                                              valid_from:
                                                type: string
                                              signature_algorithm:
                                                type: string
                                              valid_to:
                                                type: string
                                              version:
                                                type: string
                                              extensions:
                                                type: array
                                                items:
                                                  type: object
                                                  properties:
                                                    is_critical:
                                                      type: string
                                                    name:
                                                      type: string
                                                    value:
                                                      type: string
                                              signature:
                                                type: string
                                              common_name:
                                                type: string
                                              serial_number:
                                                type: string
                                              certificate_thumbprints:
                                                type: array
                                                items:
                                                  type: object
                                                  properties:
                                                    name:
                                                      type: string
                                                    value:
                                                      type: string
                                              issuer:
                                                type: object
                                                properties:
                                                  valid_from:
                                                    type: string
                                                  signature_algorithm:
                                                    type: string
                                                  valid_to:
                                                    type: string
                                                  version:
                                                    type: string
                                                  extensions:
                                                    type: array
                                                    items:
                                                      type: object
                                                      properties:
                                                        is_critical:
                                                          type: string
                                                        name:
                                                          type: string
                                                        value:
                                                          type: string
                                                  signature:
                                                    type: string
                                                  common_name:
                                                    type: string
                                                  serial_number:
                                                    type: string
                                                  certificate_thumbprints:
                                                    type: array
                                                    items:
                                                      type: object
                                                      properties:
                                                        name:
                                                          type: string
                                                        value:
                                                          type: string
                                                  issuer:
                                                    type: string
                                certificate:
                                  type: object
                                  properties:
                                    valid_from:
                                      type: string
                                    signature_algorithm:
                                      type: string
                                    valid_to:
                                      type: string
                                    version:
                                      type: string
                                    extensions:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          is_critical:
                                            type: string
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    signature:
                                      type: string
                                    common_name:
                                      type: string
                                    serial_number:
                                      type: string
                                    certificate_thumbprints:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    issuer:
                                      type: string
                            classification:
                              type: string
                            certificate_status:
                              type: string
                            sample_available:
                              type: string
                            first_seen:
                              type: string
                            threat_level:
                              type: string
                            trust_factor:
                              type: string
                            sample_type:
                              type: string
                            inserted_on:
                              type: string
                            sha256:
                              type: string
                            pe_sha256:
                              type: string
                            certificate_first_seen:
                              type: string
                            certificate_thumbprints:
                              type: array
                              items:
                                type: object
                                properties:
                                  name:
                                    type: string
                                  value:
                                    type: string
                            md5:
                              type: string
                            sha1:
                              type: string
                            pe_sha1:
                              type: string
                            sample_size:
                              type: string
                            validation:
                              type: array
                              items:
                                type: string
                            last_seen:
                              type: string
                      next_page:
                        type: string
                      request:
                        type: object
                        properties:
                          limit:
                            type: integer
                          response_format:
                            type: string
              example:
                rl:
                  request:
                    limit: 100
                    response_format: json
                  certificate_feed:
                    - sha1: 0ea569de7c4e3a4d511f89ba5ec5d6e6ce84b654
                      inserted_on: '2025-01-01 09:00:06'
                      certificate_thumbprints:
                        - name: MD5
                          value: b120e6f5f221044981b4e1061b17402d
                        - name: SHA1
                          value: 4fc6a6218d580d03bb9e16e03a6d9df4d6efecc9
                        - name: SHA256
                          value: 5886813046649B4DB4338D49CE2C71EBADDA36A708A4659B270F350D9D6E00AA
                    - sha1: 9b78a2104b7310bb2ee0aaaed6a738a450f864e8
                      inserted_on: '2025-01-01 09:00:06'
                      certificate_thumbprints:
                        - name: MD5
                          value: c170007b81ae7abd121a7baf2e3dc7ed
                        - name: SHA1
                          value: a0bb728d7a0924d13825bf92e2b212ac8f6316d7
                        - name: SHA256
                          value: 99D50A0FED3236A97357F78EE160C17DCCF6F5D4B74E8AF37EBEC5DBBEE28514
                    - sha1: b41dd2ba4447d22556955f697f785f03e82f82f7
                      inserted_on: '2025-01-01 09:00:06'
                      certificate_thumbprints:
                        - name: MD5
                          value: 253027e4e72c0745a3c3951767c5db12
                        - name: SHA1
                          value: 86bb5cc2faaabf58852c32cdd21a9a4a1de23629
                        - name: SHA256
                          value: B0FAB18A52E99ABF83D04D7864EFD76354009E9750C69718B9E3CC7B4F445575
                  next_page: 17357223982cc12f1eb4a7855c2970fb6b268d314971ac56f6
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-certificate-v1-query-from
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - schema:
            type: number
            minimum: 1
            maximum: 100
            default: 100
          in: query
          name: limit
          description: 'The maximum number of records to return in the certificate feed. '
        - schema:
            type: boolean
            default: false
            enum:
              - true
              - false
            example: false
          in: query
          name: extended
          description: The extended data set contains more metadata for samples.
        - $ref: '#/components/parameters/Classification'
      description: This service provides certificate information alongside the information about associated samples signed with the certificate(s). The feed includes valid certificates and self-signed certificates used in impersonation attempts. The information is delivered as a feed. The feed stores records for the last 365 days.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/certificate/v1/query/from/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/certificate/v1/query/from/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - name: time_format
        in: path
        schema:
          type: string
          enum:
            - timestamp
            - utc
        description: 'Required parameter that specifies the time format for the ``time_value`` parameter. Supported values: **timestamp** (Unix epoch time as the number of seconds since 1970-01-01 00:00:00); **utc** (YYYY-MM-DDThh:mm:ss).'
        required: true
      - name: time_value
        in: path
        schema:
          type: string
          example: '2020-04-20T00:00:00'
        description: Accepts values in the format set by `time_format`
        required: true
  /api/feed/certificate/v1/query/from/{time_format}/{time_value}/page/{page}:
    get:
      summary: TCF-0601 Certificate Feed API (time range) (paginated)
      tags:
        - Certificate Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      certificate_feed:
                        type: array
                        items:
                          type: object
                          properties:
                            container_sha1:
                              type: string
                            signatures:
                              type: object
                              properties:
                                counter_signatures:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      counter_signatures:
                                        type: 'null'
                                      certificate:
                                        type: object
                                        properties:
                                          valid_from:
                                            type: string
                                          signature_algorithm:
                                            type: string
                                          valid_to:
                                            type: string
                                          version:
                                            type: string
                                          extensions:
                                            type: array
                                            items:
                                              type: object
                                              properties:
                                                is_critical:
                                                  type: string
                                                name:
                                                  type: string
                                                value:
                                                  type: string
                                          signature:
                                            type: string
                                          common_name:
                                            type: string
                                          serial_number:
                                            type: string
                                          certificate_thumbprints:
                                            type: array
                                            items:
                                              type: object
                                              properties:
                                                name:
                                                  type: string
                                                value:
                                                  type: string
                                          issuer:
                                            type: object
                                            properties:
                                              valid_from:
                                                type: string
                                              signature_algorithm:
                                                type: string
                                              valid_to:
                                                type: string
                                              version:
                                                type: string
                                              extensions:
                                                type: array
                                                items:
                                                  type: object
                                                  properties:
                                                    is_critical:
                                                      type: string
                                                    name:
                                                      type: string
                                                    value:
                                                      type: string
                                              signature:
                                                type: string
                                              common_name:
                                                type: string
                                              serial_number:
                                                type: string
                                              certificate_thumbprints:
                                                type: array
                                                items:
                                                  type: object
                                                  properties:
                                                    name:
                                                      type: string
                                                    value:
                                                      type: string
                                              issuer:
                                                type: object
                                                properties:
                                                  valid_from:
                                                    type: string
                                                  signature_algorithm:
                                                    type: string
                                                  valid_to:
                                                    type: string
                                                  version:
                                                    type: string
                                                  extensions:
                                                    type: array
                                                    items:
                                                      type: object
                                                      properties:
                                                        is_critical:
                                                          type: string
                                                        name:
                                                          type: string
                                                        value:
                                                          type: string
                                                  signature:
                                                    type: string
                                                  common_name:
                                                    type: string
                                                  serial_number:
                                                    type: string
                                                  certificate_thumbprints:
                                                    type: array
                                                    items:
                                                      type: object
                                                      properties:
                                                        name:
                                                          type: string
                                                        value:
                                                          type: string
                                                  issuer:
                                                    type: string
                                certificate:
                                  type: object
                                  properties:
                                    valid_from:
                                      type: string
                                    signature_algorithm:
                                      type: string
                                    valid_to:
                                      type: string
                                    version:
                                      type: string
                                    extensions:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          is_critical:
                                            type: string
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    signature:
                                      type: string
                                    common_name:
                                      type: string
                                    serial_number:
                                      type: string
                                    certificate_thumbprints:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    issuer:
                                      type: string
                            classification:
                              type: string
                            certificate_status:
                              type: string
                            sample_available:
                              type: string
                            first_seen:
                              type: string
                            threat_level:
                              type: string
                            trust_factor:
                              type: string
                            sample_type:
                              type: string
                            inserted_on:
                              type: string
                            sha256:
                              type: string
                            pe_sha256:
                              type: string
                            certificate_first_seen:
                              type: string
                            certificate_thumbprints:
                              type: array
                              items:
                                type: object
                                properties:
                                  name:
                                    type: string
                                  value:
                                    type: string
                            md5:
                              type: string
                            sha1:
                              type: string
                            pe_sha1:
                              type: string
                            sample_size:
                              type: string
                            validation:
                              type: array
                              items:
                                type: string
                            last_seen:
                              type: string
                      next_page:
                        type: string
                      request:
                        type: object
                        properties:
                          limit:
                            type: integer
                          response_format:
                            type: string
              example:
                rl:
                  request:
                    limit: 100
                    response_format: json
                    page: 1737544518548fa80d0c18873c513ad5f3f62b087c6f2b6ca2
                  certificate_feed:
                    - sha1: 548fa80d0c18873c513ad5f3f62b087c6f2b6ca2
                      inserted_on: '2025-01-22 11:15:18'
                      certificate_thumbprints:
                        - name: MD5
                          value: 194d06aaada993dc58002c914304f202
                        - name: SHA1
                          value: 275aa98d669e3cad28db574b78a1931cae279fd2
                        - name: SHA256
                          value: 7516536470279945F2A25A88A5FC5BD57F634B0339FFF19633DE43B512E10A6D
                    - sha1: 743393a1efd367c39f72cb098e497336e974d26b
                      inserted_on: '2025-01-22 11:15:18'
                      certificate_thumbprints:
                        - name: MD5
                          value: bb56279fc991a65ece7cc0d976262a0f
                        - name: SHA1
                          value: 2c02f523c3748b1d850420b27aad3cb65671f8b9
                        - name: SHA256
                          value: A6C3BB6041DBDA60D2F073CB799A37BA40E21A11D476297DE1566FDB4502FB02
                    - sha1: ec5e215603bb9c10a23b5d95c7c25b9153cc095d
                      inserted_on: '2025-01-22 11:16:17'
                      certificate_thumbprints:
                        - name: MD5
                          value: 194d06aaada993dc58002c914304f202
                        - name: SHA1
                          value: 275aa98d669e3cad28db574b78a1931cae279fd2
                        - name: SHA256
                          value: 7516536470279945F2A25A88A5FC5BD57F634B0339FFF19633DE43B512E10A6D
                  next_page: 1737544687b095b7d255cf62fcc5687c20b7696f3e1bff528e
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-certificate-v1-query-from-paginated
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - schema:
            type: number
            minimum: 1
            maximum: 100
            default: 100
          in: query
          name: limit
          description: 'The maximum number of records to return in the certificate feed. '
        - schema:
            type: boolean
            default: false
            enum:
              - true
              - false
            example: false
          in: query
          name: extended
          description: The extended data set contains more metadata for samples.
        - $ref: '#/components/parameters/Classification'
      description: This service provides certificate information alongside the information about associated samples signed with the certificate(s). The feed includes valid certificates and self-signed certificates used in impersonation attempts. The information is delivered as a feed. The feed stores records for the last 365 days.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/certificate/v1/query/from/utc/2025-01-01T00:00:00?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/certificate/v1/query/from/utc/2025-01-01T00:00:00?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - name: time_format
        in: path
        schema:
          type: string
          enum:
            - timestamp
            - utc
        description: 'Required parameter that specifies the time format for the ``time_value`` parameter. Supported values: **timestamp** (Unix epoch time as the number of seconds since 1970-01-01 00:00:00); **utc** (YYYY-MM-DDThh:mm:ss).'
        required: true
      - name: time_value
        in: path
        schema:
          type: string
          example: '2020-04-20T00:00:00'
        description: Accepts values in the format set by `time_format`
        required: true
      - schema:
          type: string
        name: page
        in: path
        required: true
        description: The pagination value for the next page is provided in the previous request response.
  /api/feed/certificate/v1/query/latest:
    get:
      summary: TCF-0601 Certificate Feed API (latest)
      tags:
        - Certificate Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      certificate_feed:
                        type: array
                        items:
                          type: object
                          properties:
                            container_sha1:
                              type: string
                            signatures:
                              type: object
                              properties:
                                counter_signatures:
                                  type: 'null'
                                certificate:
                                  type: object
                                  properties:
                                    valid_from:
                                      type: string
                                    signature_algorithm:
                                      type: string
                                    valid_to:
                                      type: string
                                    version:
                                      type: string
                                    extensions:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          is_critical:
                                            type: string
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    signature:
                                      type: string
                                    common_name:
                                      type: string
                                    serial_number:
                                      type: string
                                    certificate_thumbprints:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    issuer:
                                      type: object
                                      properties:
                                        valid_from:
                                          type: string
                                        signature_algorithm:
                                          type: string
                                        valid_to:
                                          type: string
                                        version:
                                          type: string
                                        extensions:
                                          type: array
                                          items:
                                            type: object
                                            properties:
                                              is_critical:
                                                type: string
                                              name:
                                                type: string
                                              value:
                                                type: string
                                        signature:
                                          type: string
                                        common_name:
                                          type: string
                                        serial_number:
                                          type: string
                                        certificate_thumbprints:
                                          type: array
                                          items:
                                            type: object
                                            properties:
                                              name:
                                                type: string
                                              value:
                                                type: string
                                        issuer:
                                          type: string
                            malware_type:
                              type: string
                            classification:
                              type: string
                            certificate_status:
                              type: string
                            threat_name:
                              type: string
                            sample_available:
                              type: string
                            first_seen:
                              type: string
                            threat_level:
                              type: string
                            trust_factor:
                              type: string
                            malware_family:
                              type: string
                            sample_type:
                              type: string
                            platform:
                              type: string
                            inserted_on:
                              type: string
                            sha256:
                              type: string
                            pe_sha256:
                              type: string
                            certificate_first_seen:
                              type: string
                            certificate_thumbprints:
                              type: array
                              items:
                                type: object
                                properties:
                                  name:
                                    type: string
                                  value:
                                    type: string
                            md5:
                              type: string
                            sha1:
                              type: string
                            pe_sha1:
                              type: string
                            sample_size:
                              type: string
                            validation:
                              type: array
                              items:
                                type: string
                            last_seen:
                              type: string
                      next_page:
                        type: string
                      request:
                        type: object
                        properties:
                          limit:
                            type: integer
                          classification:
                            type: string
                          response_format:
                            type: string
              example:
                rl:
                  request:
                    limit: 100
                    response_format: json
                  certificate_feed:
                    - sha1: 958fbc6692464a8deb33a6d73088e329a0905196
                      inserted_on: '2025-01-21 10:26:18'
                      certificate_thumbprints:
                        - name: MD5
                          value: e7e367e3224c8101730dd7ffe694f01d
                        - name: SHA1
                          value: f47cd442f00c4c9bf01e923872500439c6896f6e
                        - name: SHA256
                          value: B124E258DEF70511E9ABA0EFECE22792134F986309568A0395EEA17FC3796276
                    - sha1: 6ae41b29949dcdec16ffb1ae0ad7702c02d7d885
                      inserted_on: '2025-01-21 10:26:15'
                      certificate_thumbprints:
                        - name: MD5
                          value: d66fb0b33c8a4e8bdd5e38abc8891b2f
                        - name: SHA1
                          value: 257f56d595316f1e2810d992911ac064e193830c
                        - name: SHA256
                          value: 291BF0B743D5D48D7493AA12325CFBBAA89202DFFA2D9016D3B5D03B03512F0E
                  next_page: 17374548968938aa6e7db2929debdaa604795ff894abf20d2c
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-certificate-v1-query-latest
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - schema:
            type: number
            minimum: 1
            maximum: 100
            default: 100
          in: query
          name: limit
          description: 'The maximum number of records to return in the certificate feed. '
        - schema:
            type: boolean
            default: false
            enum:
              - true
              - false
            example: false
          in: query
          name: extended
          description: The extended data set contains more metadata for samples.
        - $ref: '#/components/parameters/Classification'
      description: This service provides certificate information alongside the information about associated samples signed with the certificate(s). The feed includes valid certificates and self-signed certificates used in impersonation attempts. The information is delivered as a feed. The feed stores records for the last 365 days.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/certificate/v1/query/latest?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/certificate/v1/query/latest?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters: []
  /api/feed/certificate/v1/query/latest/page/{page}:
    get:
      summary: TCF-0601 Certificate Feed API (latest) (paginated)
      tags:
        - Certificate Indicators
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      certificate_feed:
                        type: array
                        items:
                          type: object
                          properties:
                            container_sha1:
                              type: string
                            signatures:
                              type: object
                              properties:
                                counter_signatures:
                                  type: 'null'
                                certificate:
                                  type: object
                                  properties:
                                    valid_from:
                                      type: string
                                    signature_algorithm:
                                      type: string
                                    valid_to:
                                      type: string
                                    version:
                                      type: string
                                    extensions:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          is_critical:
                                            type: string
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    signature:
                                      type: string
                                    common_name:
                                      type: string
                                    serial_number:
                                      type: string
                                    certificate_thumbprints:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          name:
                                            type: string
                                          value:
                                            type: string
                                    issuer:
                                      type: object
                                      properties:
                                        valid_from:
                                          type: string
                                        signature_algorithm:
                                          type: string
                                        valid_to:
                                          type: string
                                        version:
                                          type: string
                                        extensions:
                                          type: array
                                          items:
                                            type: object
                                            properties:
                                              is_critical:
                                                type: string
                                              name:
                                                type: string
                                              value:
                                                type: string
                                        signature:
                                          type: string
                                        common_name:
                                          type: string
                                        serial_number:
                                          type: string
                                        certificate_thumbprints:
                                          type: array
                                          items:
                                            type: object
                                            properties:
                                              name:
                                                type: string
                                              value:
                                                type: string
                                        issuer:
                                          type: string
                            malware_type:
                              type: string
                            classification:
                              type: string
                            certificate_status:
                              type: string
                            threat_name:
                              type: string
                            sample_available:
                              type: string
                            first_seen:
                              type: string
                            threat_level:
                              type: string
                            trust_factor:
                              type: string
                            malware_family:
                              type: string
                            sample_type:
                              type: string
                            platform:
                              type: string
                            inserted_on:
                              type: string
                            sha256:
                              type: string
                            pe_sha256:
                              type: string
                            certificate_first_seen:
                              type: string
                            certificate_thumbprints:
                              type: array
                              items:
                                type: object
                                properties:
                                  name:
                                    type: string
                                  value:
                                    type: string
                            md5:
                              type: string
                            sha1:
                              type: string
                            pe_sha1:
                              type: string
                            sample_size:
                              type: string
                            validation:
                              type: array
                              items:
                                type: string
                            last_seen:
                              type: string
                      next_page:
                        type: string
                      request:
                        type: object
                        properties:
                          limit:
                            type: integer
                          classification:
                            type: string
                          response_format:
                            type: string
              example:
                rl:
                  request:
                    limit: 100
                    response_format: json
                    page: 1737544518548fa80d0c18873c513ad5f3f62b087c6f2b6ca2
                  certificate_feed:
                    - sha1: 548fa80d0c18873c513ad5f3f62b087c6f2b6ca2
                      inserted_on: '2025-01-22 11:15:18'
                      certificate_thumbprints:
                        - name: MD5
                          value: 194d06aaada993dc58002c914304f202
                        - name: SHA1
                          value: 275aa98d669e3cad28db574b78a1931cae279fd2
                        - name: SHA256
                          value: 7516536470279945F2A25A88A5FC5BD57F634B0339FFF19633DE43B512E10A6D
                    - sha1: 743393a1efd367c39f72cb098e497336e974d26b
                      inserted_on: '2025-01-22 11:15:18'
                      certificate_thumbprints:
                        - name: MD5
                          value: bb56279fc991a65ece7cc0d976262a0f
                        - name: SHA1
                          value: 2c02f523c3748b1d850420b27aad3cb65671f8b9
                        - name: SHA256
                          value: A6C3BB6041DBDA60D2F073CB799A37BA40E21A11D476297DE1566FDB4502FB02
                    - sha1: 8620818a78cb6291380e6fe9180e154ee2e26a90
                      inserted_on: '2025-01-22 11:15:18'
                      certificate_thumbprints:
                        - name: MD5
                          value: bb56279fc991a65ece7cc0d976262a0f
                        - name: SHA1
                          value: 2c02f523c3748b1d850420b27aad3cb65671f8b9
                        - name: SHA256
                          value: A6C3BB6041DBDA60D2F073CB799A37BA40E21A11D476297DE1566FDB4502FB02
                  next_page: 17375444861ca05548d9f6e395c7b0670d93cd264805cf383e
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      operationId: get-api-feed-certificate-v1-query-latest-paginated
      parameters:
        - $ref: '#/components/parameters/ResponseFormat'
        - schema:
            type: number
            minimum: 1
            maximum: 100
            default: 100
          in: query
          name: limit
          description: 'The maximum number of records to return in the certificate feed. '
        - schema:
            type: boolean
            default: false
            enum:
              - true
              - false
            example: false
          in: query
          name: extended
          description: The extended data set contains more metadata for samples.
        - $ref: '#/components/parameters/Classification'
      description: This service provides certificate information alongside the information about associated samples signed with the certificate(s). The feed includes valid certificates and self-signed certificates used in impersonation attempts. The information is delivered as a feed. The feed stores records for the last 365 days.
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/feed/certificate/v1/query/latest?format=json' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/feed/certificate/v1/query/latest?format=json"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    parameters:
      - schema:
          type: string
        name: page
        in: path
        required: true
        description: The pagination value for the next page is provided in the previous request response
  /api/customer_usage/v1/management/licenses:
    get:
      summary: 'TCA-9999: List Licenses'
      tags:
        - Customer Administration & Usage
      operationId: get-api-customer_usage-v1-management_licenses
      description: Returns a list of all licenses for the company.
      parameters:
        - name: page
          in: query
          required: false
          description: Return a specific page.
          schema:
            type: integer
            minimum: 1
            example: 1
        - name: size
          in: query
          required: false
          description: The number of licenses to return per page.
          schema:
            type: integer
            minimum: 1
            example: 50
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      licenses:
                        type: array
                        items:
                          type: object
                          required:
                            - id
                            - type
                            - products
                            - limit
                            - available_limit
                            - is_unlimited
                            - limit_type
                            - start_date
                            - end_date
                            - created_at
                            - updated_at
                          properties:
                            id:
                              type: integer
                            type:
                              type: string
                            products:
                              type: array
                              items:
                                type: string
                            limit:
                              type: integer
                            available_limit:
                              type: integer
                            is_unlimited:
                              type: boolean
                            limit_type:
                              type: string
                            start_date:
                              type: string
                              format: date
                            end_date:
                              type: string
                              format: date
                            created_at:
                              type: string
                            updated_at:
                              type: string
                            strain:
                              type: string
                      page:
                        type: object
                        properties:
                          current_page:
                            type: integer
                          next:
                            type: string
                            nullable: true
                          previous:
                            type: string
                            nullable: true
                          total_pages:
                            type: integer
                          total_records:
                            type: integer
              example:
                rl:
                  licenses:
                    - available_limit: 10000
                      created_at: 2025-09-30T08:54:09+0000
                      end_date: '2026-09-30'
                      id: 6427
                      is_unlimited: false
                      limit: 10000
                      limit_type: DAILY
                      products:
                        - TCA-0314
                      start_date: '2025-09-30'
                      strain: PRODUCTS
                      type: ACTIVE
                      updated_at: 2025-09-30T09:03:41+0000
                  page:
                    current_page: 1
                    next: null
                    previous: null
                    total_pages: 1
                    total_records: 2
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/customer_usage/v1/management/limits:
    post:
      summary: 'TCA-9999: Create Limit'
      tags:
        - Customer Administration & Usage
      operationId: post-api-customer_usage-v1-management_limits
      description: Creates a new limit for a specific license.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - license_id
                - usernames
              properties:
                license_id:
                  type: integer
                  description: The ID of the license to create the limit for.
                is_unlimited:
                  type: boolean
                  description: Whether the limit is unlimited. Mutually exclusive with `limit`, unless `is_unlimited` is set to `false`.
                limit:
                  type: integer
                  description: The limit to set. Mutually exclusive with `is_unlimited`, unless `is_unlimited` is set to `false`.
                usernames:
                  type: array
                  items:
                    type: string
                  description: The usernames to set the limit for.
              example:
                license_id: 6427
                is_unlimited: false
                limit: 10000
                usernames:
                  - u/company/user
      responses:
        '201':
          description: Limit created successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      id:
                        type: integer
                      license_id:
                        type: integer
                      is_unlimited:
                        type: boolean
                      limit:
                        type: integer
                      usernames:
                        type: array
                        items:
                          type: string
                      created_at:
                        type: string
                        format: date-time
                      updated_at:
                        type: string
                        format: date-time
                        nullable: true
              example:
                rl:
                  id: 20939
                  license_id: 6427
                  is_unlimited: false
                  limit: 10000
                  usernames:
                    - u/company/user
                  created_at: 2025-10-15T05:51:46+0000
                  updated_at: null
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/customer_usage/v1/management/licenses/{strain}/{license_id}/limits:
    get:
      summary: 'TCA-9999: Read License Limits'
      tags:
        - Customer Administration & Usage
      operationId: get-api-customer_usage-v1-management_licenses_{strain}_{license_id}_limits
      description: Returns a list of limits created for a specific license.
      parameters:
        - name: strain
          in: path
          required: true
          description: The strain of the license to retrieve limits for.
          schema:
            type: string
            enum:
              - PRODUCTS
              - BUNDLE
        - name: license_id
          in: path
          required: true
          description: The ID of the license to retrieve limits for.
          schema:
            type: integer
        - name: page
          in: query
          required: false
          description: Return a specific page.
          schema:
            type: integer
            minimum: 1
            example: 1
        - name: size
          in: query
          required: false
          description: The number of limits to return per page.
          schema:
            type: integer
            minimum: 1
            example: 50
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      limits:
                        type: array
                        items:
                          type: object
                          required:
                            - id
                            - license_id
                            - is_unlimited
                            - limit
                            - usernames
                            - created_at
                          properties:
                            id:
                              type: integer
                            license_id:
                              type: integer
                            is_unlimited:
                              type: boolean
                            limit:
                              type: integer
                            usernames:
                              type: array
                              items:
                                type: string
                            created_at:
                              type: string
                              format: date-time
                            updated_at:
                              type: string
                              format: date-time
                              nullable: true
                            strain:
                              type: string
                      page:
                        type: object
                        properties:
                          current_page:
                            type: integer
                          next:
                            type: string
                            nullable: true
                          previous:
                            type: string
                            nullable: true
                          total_pages:
                            type: integer
                          total_records:
                            type: integer
              example:
                rl:
                  limits:
                    - created_at: 2025-10-15T05:51:46+0000
                      id: 20939
                      is_unlimited: false
                      license_id: 6427
                      limit: 10000
                      updated_at: null
                      usernames:
                        - u/company/user
                      strain: PRODUCTS
                  page:
                    current_page: 1
                    next: null
                    previous: null
                    total_pages: 1
                    total_records: 1
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/customer_usage/v1/management/users/{username}/limits:
    get:
      summary: 'TCA-9999: Read User Limits'
      tags:
        - Customer Administration & Usage
      operationId: get-api-customer_usage-v1-management_users_{username}_limits
      description: Returns a list of limits created for a specific user.
      parameters:
        - name: username
          in: path
          required: true
          description: The base64-encoded username to retrieve limits for.
          schema:
            type: string
        - name: page
          in: query
          required: false
          description: Return a specific page.
          schema:
            type: integer
            minimum: 1
            example: 1
        - name: size
          in: query
          required: false
          description: The number of limits to return per page.
          schema:
            type: integer
            minimum: 1
            example: 50
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      limits:
                        type: array
                        items:
                          type: object
                          required:
                            - id
                            - license_id
                            - is_unlimited
                            - limit
                            - usernames
                            - created_at
                            - strain
                          properties:
                            id:
                              type: integer
                            license_id:
                              type: integer
                            is_unlimited:
                              type: boolean
                            limit:
                              type: integer
                            usernames:
                              type: array
                              items:
                                type: string
                            created_at:
                              type: string
                              format: date-time
                            updated_at:
                              type: string
                              format: date-time
                              nullable: true
                            strain:
                              type: string
                      page:
                        type: object
                        properties:
                          current_page:
                            type: integer
                          next:
                            type: string
                            nullable: true
                          previous:
                            type: string
                            nullable: true
                          total_pages:
                            type: integer
                          total_records:
                            type: integer
              example:
                rl:
                  limits:
                    - created_at: 2025-10-15T05:51:46+0000
                      id: 20939
                      is_unlimited: false
                      license_id: 6427
                      limit: 10000
                      updated_at: null
                      usernames:
                        - u/company/user
                  page:
                    current_page: 1
                    next: null
                    previous: null
                    total_pages: 1
                    total_records: 1
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/customer_usage/v1/management/limits/{limit_id}:
    put:
      summary: 'TCA-9999: Update Limit'
      tags:
        - Customer Administration & Usage
      operationId: get-api-customer_usage-v1-management_limits_put_limit_id
      description: Updates an existing limit.
      parameters:
        - name: limit_id
          in: path
          required: true
          description: The ID of the limit to update.
          schema:
            type: integer
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                is_unlimited:
                  type: boolean
                  description: Whether the limit is unlimited.
                limit:
                  type: integer
                  description: The limit to set.
                usernames:
                  type: array
                  items:
                    type: string
                  description: The usernames to set the limit for.
              example:
                is_unlimited: false
                limit: 1000
                usernames:
                  - u/company/user
                  - u/company/user2
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      id:
                        type: integer
                      license_id:
                        type: integer
                      is_unlimited:
                        type: boolean
                      limit:
                        type: integer
                      usernames:
                        type: array
                        items:
                          type: string
                      created_at:
                        type: string
                        format: date-time
                      updated_at:
                        type: string
                        format: date-time
                        nullable: true
              example:
                rl:
                  created_at: 2025-10-15T05:51:46+0000
                  id: 20939
                  is_unlimited: false
                  license_id: 6427
                  limit: 1000
                  updated_at: 2025-10-15T06:05:14+0000
                  usernames:
                    - u/company/user
                    - u/company/user2
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
    delete:
      summary: 'TCA-9999: Delete Limit'
      tags:
        - Customer Administration & Usage
      operationId: get-api-customer_usage-v1-management_limits_delete_limit_id
      description: Deletes a limit.
      parameters:
        - name: limit_id
          in: path
          required: true
          description: The ID of the limit to delete.
          schema:
            type: integer
      responses:
        '204':
          description: The request has succeeded.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
  /api/customer_usage/v1/management/companies:
    get:
      tags:
        - Customer Administration & Usage
      summary: 'TCA-9999: Company Information'
      description: Returns the number of users and the company name for the company the authenticated user belongs to.
      operationId: getCompanyInformation
      responses:
        '200':
          description: Company information retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CompanyInformationResponse'
              examples:
                example:
                  value:
                    name: Company
                    user_count: 250
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '406':
          $ref: '#/components/responses/NotAcceptable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
    components:
      schemas:
        CompanyInformationResponse:
          type: object
          properties:
            name:
              type: string
              description: The name of the company
              example: Company
            user_count:
              type: integer
              description: The number of users in the company
              example: 250
          required:
            - name
            - user_count
  /api/oss/community/v2/find/packages:
    post:
      summary: 'TCA-0701: Search for packages'
      tags:
        - Supply Chain Security
      description: |-
        Search the Spectra Assure Community catalogue for information on one or more software packages specified in the request. The response contains the list of all software packages that match the search criteria.

        Enterprise users can search for a maximum of 50 packages per request. 

        To search for a package, provide either of the following in the request body:

        - the correct **purl** (package URL) in the format `pkg:community/namespace/package@version`. The `version` part of the purl may be omitted. In that case, the API returns information about the latest published version of the software package. It's also possible to search for packages by partial purl with matching patterns and version expressions.    

        - the package **hash** in the SHA1 or SHA256 format. When searching for packages by hash, the results will include packages with that hash as well as those that contain it. Note that hashes of embedded files are tracked only if they are malware artifacts.

        For more advanced search queries, the request body supports matching a range of package versions by a glob pattern or a community-specific version expression. It is also possible to search for artifacts by file name or tag, but only in software repositories (communities) that support multiple version artifacts for software packages.

        Every request must also contain a unique search identifier string that will be included in the response. The string value is arbitrary.

        To make integrations easier, you can use the `compact` query parameter in the request. This parameter instructs the API to return a simplified response in which all optional fields are automatically omitted.   
      operationId: postFindPackageMetadata
      requestBody:
        $ref: '#/components/requestBodies/json_search'
      parameters:
        - $ref: '#/components/parameters/query_offset'
        - $ref: '#/components/parameters/query_limit'
        - $ref: '#/components/parameters/is_compact'
      responses:
        '200':
          $ref: '#/components/responses/oss-search'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '402':
          $ref: '#/components/responses/low-capacity'
        '403':
          $ref: '#/components/responses/forbidden'
        '413':
          $ref: '#/components/responses/content-too-large'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/server-error'
      x-codeSamples:
        - lang: bash
          source: |
            curl --request POST --url 'https://data.reversinglabs.com/api/oss/community/v2/find/packages' --header 'Content-Type: application/json' --data '{
                [
                  {
                    "uuid": "12-01",
                    "purl": "pkg:pypi/numpy@1.2.3"
                  },
                  {
                    "uuid": "13-01",
                    "sha256": "94957715a483aa3b9db60c8f22d5498227d8025c407f982eef81e34f37574ffd"
                  }
                ]
             }' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            import json

            url = "https://data.reversinglabs.com/api/oss/community/v2/find/packages"

            json = {
                [
                  {
                    "uuid": "12-01",
                    "purl": "pkg:pypi/numpy@1.2.3"
                  },
                  {
                    "uuid": "13-01",
                    "sha256": "94957715a483aa3b9db60c8f22d5498227d8025c407f982eef81e34f37574ffd"
                  }
                ]
            }

            response = requests.post(url, json=json, auth=('username', 'password'))

            print(response.text)
    components:
      schemas:
        oss-version:
          type: object
          required:
            - community
          properties:
            community:
              description: Spectra Assure Community analysis report for a package version.
              type: object
              required:
                - report
              properties:
                report:
                  type: object
                  required:
                    - info
                  properties:
                    info:
                      type: object
                      required:
                        - file
                        - analysis
                      properties:
                        file:
                          $ref: '#/components/schemas/file'
                        analysis:
                          type: object
                          required:
                            - version
                            - timestamp
                          properties:
                            version:
                              type: string
                              description: Spectra Assure core analysis engine version.
                            timestamp:
                              type: string
                              description: Last package analysis time as ISO-8601 string.
                        statistics:
                          $ref: '#/components/schemas/statistics'
                        detections:
                          $ref: '#/components/schemas/detections'
                        disabled:
                          type: array
                          description: List of disabled policy checks.
                    metadata:
                      type: object
                      properties:
                        assessments:
                          $ref: '#/components/schemas/assessments'
                        incidents:
                          $ref: '#/components/schemas/incidents'
                        violations:
                          $ref: '#/components/schemas/violations'
                        indicators:
                          $ref: '#/components/schemas/indicators'
                        classifications:
                          $ref: '#/components/schemas/classifications'
                        vulnerabilities:
                          $ref: '#/components/schemas/vulnerabilities-2'
                        dependencies:
                          $ref: '#/components/schemas/dependencies'
        oss-package:
          type: object
          required:
            - community
          properties:
            community:
              type: object
              description: Spectra Assure Community analysis report for a package.
              allOf:
                - $ref: '#/components/schemas/package'
                - type: object
                  required:
                    - contributors
                  properties:
                    contributors:
                      $ref: '#/components/schemas/contributors'
        oss-search:
          type: object
          required:
            - community
          properties:
            community:
              type: object
              description: Results of a Spectra Assure Community search.
              required:
                - packages
              properties:
                packages:
                  type: array
                  description: One or more software packages that match the search criteria from the request.
                  items:
                    required:
                      - uuid
                      - package
                    properties:
                      uuid:
                        $ref: '#/components/schemas/uuid'
                      package:
                        $ref: '#/components/schemas/package'
                errors:
                  type: array
                  items:
                    required:
                      - uuid
                      - error
                    properties:
                      uuid:
                        $ref: '#/components/schemas/uuid'
                      error:
                        type: object
                        description: Package lookup error information.
                        required:
                          - code
                          - info
                        properties:
                          code:
                            type: integer
                            description: Package lookup HTTP error code.
                          info:
                            type: string
                            description: Package lookup HTTP error code description.
        uuid:
          type: string
          description: Unique, user-provided search identifier tied to each search query. The server returns this identifier in the response.
          example: 12-01
        communities:
          type: string
          enum:
            - npm
            - pypi
            - gem
            - nuget
            - vsx
            - psgallery
          description: Open source community identifier of the software repository that hosts the requested software package. Must match one of the [software repositories](https://docs.secure.software/community/#supported-communities) supported by Spectra Assure Community.
          example: npm
        identity:
          type: object
          required:
            - purl
            - community
            - namespace
            - package
            - product
            - version
            - artifact
            - license
            - published
            - deprecated
            - removed
            - category
            - homepage
            - repository
            - description
          properties:
            purl:
              type: string
              description: Fully qualified software package URL (including the artifact reference).
              example: pkg:npm/mock_react@19.0.0
            community:
              $ref: '#/components/schemas/communities'
            namespace:
              type: string
              description: Namespace of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: ''
            package:
              type: string
              description: Name of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: mock_react
            product:
              type: string
              description: Product name as declared by the publisher.
              example: Mock React
            version:
              type: string
              nullable: true
              description: Version of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: 19.0.0
            artifact:
              type: string
              nullable: true
              description: Artifact file name (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: ''
            license:
              type: string
              description: 'Package license as the SPDX license expression. The format is ReversingLabs-specific: LicenseFamily (SPDX-expression).'
              example: MIT
            published:
              type: string
              description: Package version publication date as ISO-8601 string.
              example: 2024-12-05T18:10:21+0000
            deprecated:
              type: boolean
              nullable: true
              description: Indicates if the version has been deprecated. Can be null if information is not available.
              example: false
            removed:
              type: boolean
              description: Indicates if the version has been removed.
              example: false
            category:
              type: string
              nullable: true
              description: Indicates the software category for the package version. Can be null if information is not available.
              example: ''
            homepage:
              type: string
              description: Package homepage or related website.
              example: www.example.com
            repository:
              type: string
              description: Source code related to the package.
              example: https://github.com/facebook/react
            description:
              type: string
              description: Package description as declared by the publisher.
              example: Mock React package for testing purposes.
            keywords:
              type: array
              description: Keywords associated with the software package.
        impl_quality:
          type: object
          required:
            - status
            - priority
            - assessment
          properties:
            status:
              type: string
              enum:
                - fail
                - warning
                - pass
              description: Overall package risk assessment evaluation result/status.
            priority:
              type: integer
              description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest). Optional.
              nullable: true
            assessment:
              type: string
              description: Overall package deployment risk.
            metrics:
              type: object
              description: Software quality metrics.
              required:
                - high
                - medium
                - low
              properties:
                high:
                  type: integer
                  description: Total number of policy violations with high severity on components.
                medium:
                  type: integer
                  description: Total number of policy violations with medium severity on components.
                low:
                  type: integer
                  description: Total number of policy violations with low severity on components.
        impl_artifacts:
          type: array
          items:
            type: object
            description: Artifacts related to the package version.
            required:
              - type
              - ref
            properties:
              type:
                type: string
                enum:
                  - linked-package
                  - rl-sbom-cyclonedx
                  - rl-sbom-spdx
                  - rl-safe
                description: Package artifact type. Linked packages are found in the package repository. RL packages are Spectra Assure generated artifacts. They might not be available for all packages or package versions.
                example: linked-package
              ref:
                type: string
                description: Package artifact reference. Linked packages use file names as references. RL packages use SHA-256 hashes as references.
                example: mock-1.22.4-.tar.gz'
        impl_assessment:
          type: object
          required:
            - final
            - enabled
            - status
            - priority
            - label
            - violations
            - count
          properties:
            final:
              type: boolean
              description: Risk is considered deciding when the final value is set to true.
            enabled:
              type: boolean
              description: Indicates that the risk assessment was performed during analysis. Spectra Assure license determines which risk assessments are performed.
            status:
              type: string
              enum:
                - fail
                - warning
                - pass
              description: Risk assessment evaluation result/status.
            priority:
              type: integer
              description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest). Optional.
              nullable: true
            label:
              type: string
              description: Risk assessment label to be displayed to the user.
            violations:
              type: array
              description: Policy violations that have caused the reported risk.
              items:
                type: string
            count:
              type: integer
              description: Number of risk associated with the risk label.
        assessments:
          type: object
          required:
            - licenses
            - malware
            - hardening
            - secrets
            - tampering
            - vulnerabilities
          properties:
            licenses:
              $ref: '#/components/schemas/impl_assessment'
            malware:
              $ref: '#/components/schemas/impl_assessment'
            hardening:
              $ref: '#/components/schemas/impl_assessment'
            secrets:
              $ref: '#/components/schemas/impl_assessment'
            tampering:
              $ref: '#/components/schemas/impl_assessment'
            vulnerabilities:
              $ref: '#/components/schemas/impl_assessment'
            repository:
              $ref: '#/components/schemas/impl_assessment'
        incidents:
          type: object
          additionalProperties:
            type: object
            required:
              - type
              - reporters
            properties:
              type:
                type: string
                enum:
                  - malware
                  - removal
                description: Describes the type of the incident.
              reporters:
                type: array
                items:
                  type: object
                  required:
                    - type
                    - name
                    - date
                    - link
                  properties:
                    type:
                      type: string
                      enum:
                        - rl-analyst
                        - rl-scanner
                        - community
                      description: Incident reporter. Differentiates between analysts, automated reporting, and community contributions.
                    name:
                      type: string
                      description: Incident reporter name. Name is displayed to the user within the UI.
                    date:
                      type: string
                      description: Incident date as ISO-8601 string.
                    link:
                      type: string
                      description: Link to a resource that contains more information on the incident. Value is optional.
        impl_versions:
          type: array
          items:
            type: object
            description: List of package versions and their most important details.
            required:
              - version
              - published
              - incidents
            properties:
              version:
                type: string
                description: Package version.
                example: 19.0.0
              published:
                type: string
                description: Package version publication date as ISO-8601 string.
                example: 2024-12-05T18:10:21+0000
              quality:
                $ref: '#/components/schemas/impl_quality'
              artifacts:
                $ref: '#/components/schemas/impl_artifacts'
              assessments:
                $ref: '#/components/schemas/assessments'
              incidents:
                $ref: '#/components/schemas/incidents'
        impl_incidents:
          type: object
          description: Statistics for incidents reported for any package version.
          required:
            - malware
            - recent_malware
            - removal
            - recent_removal
          properties:
            malware:
              type: integer
              description: Total number of malware incidents reported for the package.
              example: 0
            recent_malware:
              type: object
              description: Describes malware incidents.
              required:
                - latest_version
                - latest_timestamp
                - recent_count
              properties:
                latest_version:
                  type: string
                  description: The latest malware package version.
                latest_timestamp:
                  type: string
                  description: The time when the latest malware version was published as ISO-8601 string.
                recent_count:
                  type: integer
                  description: The number of malware incidents in the last two years.
            removal:
              type: integer
              description: Total number of removal incidents reported for the package.
              example: 1
            recent_removal:
              type: object
              description: Describes removal incidents.
              required:
                - latest_version
                - latest_timestamp
                - recent_count
              properties:
                latest_version:
                  type: string
                  description: The latest removed package version.
                  example: 1.2.0rc1
                latest_timestamp:
                  type: string
                  description: The time when the latest package removal occurred as ISO-8601 string.
                  example: 2020-05-14T11:25:54+0000
                recent_count:
                  type: integer
                  description: The number of removal incidents in the last two years.
                  example: 0
        package:
          type: object
          description: Software package metadata.
          required:
            - owner_verified
            - is_quarantined
            - first_published
            - total_versions
            - total_installs
            - total_downloads
            - latest_version
            - direct_imports
            - all_malicious
            - was_archived
            - was_removed
            - key_project
            - popularity
            - identity
            - versions
            - incidents
          properties:
            owner_verified:
              type: boolean
              description: Indicates that package ownership was verified by the package repository.
              example: false
            is_quarantined:
              type: boolean
              description: Indicates that the package may be quarantined in the package repository.
              nullable: true
            first_published:
              type: string
              description: Initial package publication date as ISO-8601 string.
              example: 2022-04-26T18:40:14+0000
            total_versions:
              type: integer
              description: Total number of currently published package/extension versions.
              example: 7
            total_installs:
              type: integer
              description: Total number of package/extension installations as tracked by the package repository.
              nullable: true
            total_downloads:
              type: integer
              description: Total number of package/extension downloads as tracked by the package repository.
              nullable: true
              example: 6231
            latest_version:
              type: string
              description: Latest published package version.
              example: 7.0.0
            direct_imports:
              type: integer
              description: Total number of other packages in the repository that directly import this one.
              nullable: true
              example: 312
            all_malicious:
              type: boolean
              description: Indicates that currently all package versions are reported as malware.
              example: false
            was_archived:
              type: boolean
              description: Indicates that the package may be archived in the package repository.
              nullable: true
            was_removed:
              type: boolean
              description: Indicates that the package was completely removed from the package repository.
              example: false
            key_project:
              type: boolean
              description: Indicates that the package is considered to be a key project in the community.
              example: false
            popularity:
              type: integer
              enum:
                - 10
                - 100
                - 1000
                - 10000
              description: Package ranking in the community based on the number of downloads.
              example: 1000
              nullable: true
            identity:
              $ref: '#/components/schemas/identity'
            versions:
              $ref: '#/components/schemas/impl_versions'
            incidents:
              $ref: '#/components/schemas/impl_incidents'
        oss-error:
          type: object
          required:
            - error
          properties:
            error:
              type: string
        hashes:
          type: array
          items:
            type: string
        file:
          type: object
          description: Details about the software package file.
          required:
            - name
            - size
            - source_url
            - downloaded
            - hashes
          properties:
            name:
              type: string
              description: Package artifact file name.
            size:
              type: integer
              description: Package artifact size in bytes.
            source_url:
              type: string
              description: Location of the package artifact in the remote repository.
            downloaded:
              type: boolean
              description: Indicates that the package has been successfully downloaded from the repository.
            hashes:
              type: array
              items:
                $ref: '#/components/schemas/hashes'
            identity:
              $ref: '#/components/schemas/identity'
        license:
          type: object
          description: Discovered license statistics.
          required:
            - undeclared
            - public_domain
            - permissive
            - weak_copyleft
            - copyleft
            - freeware
            - shareware
            - freemium
            - non_commercial
            - proprietary
          properties:
            undeclared:
              type: integer
              description: Number of software components and dependencies without a declared license.
            public_domain:
              type: integer
              description: Number of public domain software licenses.
            permissive:
              type: integer
              description: Number of permissive software licenses.
            weak_copyleft:
              type: integer
              description: Number of weak copyleft software licenses.
            copyleft:
              type: integer
              description: Number of copyleft software licenses.
            freeware:
              type: integer
              description: Number of freeware software licenses.
            shareware:
              type: integer
              description: Number of shareware software licenses.
            freemium:
              type: integer
              description: Number of freemium software licenses.
            non_commercial:
              type: integer
              description: Number of non-commercial software licenses.
            proprietary:
              type: integer
              description: Number of proprietary software licenses.
        vulnerabilities:
          type: object
          description: Discovered vulnerability statistics.
          properties:
            total:
              type: integer
              description: Total number of detected vulnerabilities.
            critical:
              type: integer
              description: Total number of critical severity vulnerabilities.
            high:
              type: integer
              description: Total number of high severity vulnerabilities.
            medium:
              type: integer
              description: Total number of medium severity vulnerabilities.
            low:
              type: integer
              description: Total number of low severity vulnerabilities.
            exploit:
              type: integer
              description: Number of vulnerabilities that have a known exploit.
            malware:
              type: integer
              description: Number of vulnerabilities that are exploited by malware.
            mandate:
              type: integer
              description: Number of vulnerabilities that are patching-mandated.
            fixable:
              type: integer
              description: Number of vulnerabilities that can be resolved by a package version update.
            named:
              type: integer
              description: Number of vulnerabilities that have distinguished marketing names.
        quality:
          type: object
          description: Overall software quality metrics.
          required:
            - status
            - priority
            - metrics
          properties:
            status:
              type: string
              enum:
                - fail
                - pass
              description: Overall software package policy evaluation result.
            priority:
              type: integer
              description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest).
            metrics:
              type: object
              description: Software quality metrics.
              required:
                - total
                - pass
                - warning
                - fail
                - high
                - medium
                - low
              properties:
                total:
                  type: integer
                  description: Total number of policy violations on components.
                pass:
                  type: integer
                  description: Total number of policy violations that passed on components.
                warning:
                  type: integer
                  description: Total number of policy violations that caused a warning on components.
                fail:
                  type: integer
                  description: Total number of policy violations that caused a failure on components.
                high:
                  type: integer
                  description: Total number of policy violations with high severity on components.
                medium:
                  type: integer
                  description: Total number of policy violations with medium severity on components.
                low:
                  type: integer
                  description: Total number of policy violations with low severity on components.
        statistics:
          type: object
          properties:
            components:
              type: integer
              description: Number of software components discovered during Spectra Assure analysis.
            dependencies:
              type: integer
              description: Number of software dependencies discovered during Spectra Assure analysis.
            extracted:
              type: integer
              description: Number of artifacts extracted during Spectra Assure analysis.
            license:
              $ref: '#/components/schemas/license'
            vulnerabilities:
              $ref: '#/components/schemas/vulnerabilities'
            quality:
              $ref: '#/components/schemas/quality'
        detections:
          type: object
          description: File classification results.
          additionalProperties:
            type: object
            description: Detected threat type if any. 'No Threats Detected' used for Goodware and Unknown results.
            additionalProperties:
              type: integer
              description: Number of files that were detected as threats.
          example:
            Goodware:
              No Threats Detected: 19
            Malicious:
              Downloader: 1
        violations:
          type: object
          additionalProperties:
            type: object
            required:
              - rule_id
              - status
              - priority
              - severity
              - category
              - description
              - statistics
            properties:
              rule_id:
                type: string
                description: 'Unique policy identifier. A four digit number prefixed by a type identifier: SQ (software quality) or TH (threat hunting).'
              status:
                type: string
                enum:
                  - fail
                  - warning
                  - pass
                description: Policy evaluation result/status.
              priority:
                type: integer
                enum:
                  - 0
                  - 1
                  - 2
                  - 3
                  - 4
                description: Recommended policy violation fix priority. Range from P0 (highest) to P4 (lowest).
              severity:
                type: string
                enum:
                  - high
                  - medium
                  - low
                description: Severity/impact of the matching policy.
              category:
                type: string
                description: Category of the matching policy.
              description:
                type: string
                description: Display label for the matching policy.
              statistics:
                type: object
                required:
                  - applicable
                  - enforcements
                  - exclusions
                  - violations
                properties:
                  applicable:
                    type: integer
                    description: Number of files that the policy can be applied to.
                  enforcements:
                    type: integer
                    description: Number of files that have failed due to the policy match.
                  exclusions:
                    type: integer
                    description: Number of files that have an excluded policy match.
                  violations:
                    type: integer
                    description: Number of files that have the policy match.
        indicators:
          type: object
          additionalProperties:
            type: object
            required:
              - rule_id
              - priority
              - category
              - description
              - exclusions
              - occurrences
              - violations
            properties:
              rule_id:
                type: string
                description: 'Unique behavior identifier. A four digit number prefixed by a type identifier: BH (behavior).'
              priority:
                type: integer
                description: Helps order behaviors for display. More impactful behaviors have a higher priority value.
              category:
                type: string
                description: Category that best describes the behavior.
              description:
                type: string
                description: Human-readable behavior description.
              exclusions:
                type: integer
                description: Number of files that have an excluded behavior match.
              occurrences:
                type: integer
                description: Number of files that have exhibit this behavior.
              violations:
                type: integer
                description: Number of files that have failed due to the behavior presence.
        classifications:
          type: array
          items:
            type: object
            required:
              - status
              - result
            properties:
              status:
                type: string
                enum:
                  - Malicious
                  - Suspicious
                description: File classification.
              result:
                type: string
                description: Fully qualified threat name. String validation can be done with the ReversingLabs Malware Naming Standard.
              hashes:
                type: array
                items:
                  $ref: '#/components/schemas/hashes'
        vulnerabilities-2:
          type: object
          additionalProperties:
            type: object
            required:
              - name
              - cvss
              - updated
              - affects
              - audit
              - exploit
            properties:
              name:
                type: string
                description: Popular vulnerability name. Usually used by media or marketing departments.
              cvss:
                type: object
                required:
                  - version
                  - baseScore
                properties:
                  version:
                    type: integer
                    description: CVSS schema version.
                  baseScore:
                    type: number
                    format: float
                    description: CVSS base score.
              updated:
                type: string
                description: Last vulnerability database update timestamp as ISO-8601 string.
              affects:
                type: array
                description: List of dependency PURLs affected by this vulnerability. For non-declared dependencies value 'non-manifest-component' is used.
              audit:
                type: object
                required:
                  - author
                  - timestamp
                  - reason
                properties:
                  author:
                    type: string
                    description: When vulnerabilities are triaged the audit record is populated to track who triaged the vulnerability.
                  timestamp:
                    type: string
                    description: When vulnerabilities are triaged the audit record is populated to track when vulnerability was triaged. Timestamp is a ISO-8601 string.
                  reason:
                    type: string
                    description: When vulnerabilities are triaged the audit record is populated to track the reason why the triage was performed. User-provided reason.
              exploit:
                type: array
                description: List of tags that describe the vulnerability.
                items:
                  type: string
                  enum:
                    - UNKNOWN
                    - EXISTS
                    - MALWARE
                    - MANDATE
                    - FIXABLE
                    - TRIAGED
        dependencies:
          type: object
          additionalProperties:
            type: object
            required:
              - type
              - purl
              - community
              - framework
              - product
              - version
              - license
              - vulnerabilities
            properties:
              type:
                type: string
                enum:
                  - package
                  - extension
                description: Software dependency declared by the package repository.
              purl:
                type: string
                description: Fully qualified package identifier (including the artifact reference)
              community:
                type: string
                enum:
                  - managed
                  - python
                  - java
                  - ruby
                  - nodejs
                  - vscode
                  - powershell
                description: OSS community in which the dependency is published.
              framework:
                type: string
                description: Defines the framework requirements needed to run the dependency. Currently only for .NET/managed community use.
              product:
                type: string
                description: Product name as declared by the publisher.
              version:
                type: string
                description: PURL - version from pkg:community/namespace/package@version
              license:
                type: string
                description: 'Package license as the SPDX license expression. The format is ReversingLabs-specific: LicenseFamily (SPDX-expression).'
              vulnerabilities:
                type: array
                description: List of CVEs that were detected to affect the dependency.
        contributors:
          type: array
          items:
            type: object
            description: List of package contributor roles and people related to the project.
            required:
              - role
              - name
              - user
              - email
            properties:
              role:
                type: string
                enum:
                  - developer
                  - maintainer
                  - author
                  - contributor
                  - owner
                description: Project contributor role.
              name:
                type: string
                description: Display name of the account associated with the contributor in the package repository.
              user:
                type: string
                description: User name of the account associated with the contributor in the package repository.
              email:
                type: string
                description: E-mail account associated with the contributor in the package repository.
      parameters:
        query_offset:
          name: offset
          in: query
          description: This optional parameter is used for pagination to specify the starting index when enumerating package versions in the response.
          required: false
          schema:
            type: integer
            default: 0
        query_limit:
          name: limit
          in: query
          description: Specify the maximum number of package versions to include in the response.
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 5
        is_compact:
          name: compact
          in: query
          description: When this parameter is specified in the request, all optional response fields are automatically removed from the response to reduce its size. Intended for OEM and product integrations.
          required: false
          schema:
            type: boolean
            default: false
      requestBodies:
        json_search:
          required: true
          content:
            application/json:
              schema:
                type: array
                items:
                  oneOf:
                    - type: object
                      title: SearchByPurl
                      required:
                        - uuid
                        - purl
                      properties:
                        uuid:
                          $ref: '#/components/schemas/uuid'
                        purl:
                          type: string
                          description: Fully qualified package URL (purl) of the software package to search for, in the format `pkg:community/namespace/package@version`. If the `version` part of the purl is omitted, the response contains information about the latest published version. The purl is case-insensitive. For more information on the correct purl syntax, consult the [official purl specification](https://github.com/package-url/purl-spec/blob/main/purl-specification.md#rules-for-each-purl-component).
                          example: pkg:pypi/numpy@1.2.3
                    - type: object
                      title: SearchBySha1
                      required:
                        - uuid
                        - sha1
                      properties:
                        uuid:
                          $ref: '#/components/schemas/uuid'
                        sha1:
                          type: string
                          description: Search for a package with this hash, or packages that contain this hash. Hashes of embedded files are tracked only if they are malware artifacts.
                          example: d63932d669fe6da664b4183d8e1d5a33a9492b9f
                    - type: object
                      title: SearchBySha256
                      required:
                        - uuid
                        - sha256
                      properties:
                        uuid:
                          $ref: '#/components/schemas/uuid'
                        sha256:
                          type: string
                          description: Search for a package with this hash, or packages that contain this hash. Hashes of embedded files are tracked only if they are malware artifacts.
                          example: 94957715a483aa3b9db60c8f22d5498227d8025c407f982eef81e34f37574ffd
                    - type: object
                      title: MatchPurlByPattern
                      required:
                        - uuid
                        - purl
                        - match_pattern
                      properties:
                        uuid:
                          $ref: '#/components/schemas/uuid'
                        purl:
                          type: string
                          description: 'Partial package URL (purl) of the software package to search for. Must satisfy the following purl schema: `pkg:community/namespace/package?artifact=filename.ext`. For more information on the correct purl syntax, consult the [official purl specification](https://github.com/package-url/purl-spec/blob/main/purl-specification.md#rules-for-each-purl-component).'
                          example: pkg:pypi/mock-numpy
                        match_pattern:
                          type: string
                          description: Search for all versions that match the community-agnostic glob pattern.
                          example: 1.*.*
                    - type: object
                      title: MatchPurlByExpression
                      required:
                        - uuid
                        - purl
                        - match_expression
                      properties:
                        uuid:
                          $ref: '#/components/schemas/uuid'
                        purl:
                          type: string
                          description: 'Partial package URL (purl) of the software package to search for. Must satisfy the following purl schema: `pkg:community/namespace/package?artifact=filename.ext`. For more information on the correct purl syntax, consult the [official purl specification](https://github.com/package-url/purl-spec/blob/main/purl-specification.md#rules-for-each-purl-component).'
                          example: pkg:pypi/mock-numpy
                        match_expression:
                          type: string
                          description: Search for all versions that match the community-specific expression.
                          example: '> 1.3.4'
                    - type: object
                      title: MatchArtifacts
                      required:
                        - uuid
                        - community
                        - package
                      properties:
                        uuid:
                          $ref: '#/components/schemas/uuid'
                        community:
                          $ref: '#/components/schemas/communities'
                        namespace:
                          type: string
                          description: The namespace part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact=filename.ext`).
                        package:
                          type: string
                          description: The package part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact=filename.ext`).
                        version:
                          type: string
                          description: The version part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact=filename.ext`).
                        artifact:
                          type: string
                          description: The artifact part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact=filename.ext`). Note that some software repositories (communities) do not support searching for artifacts.
                        artifact_tag:
                          type: string
                          description: The artifact_tag part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact_tag=example_tag`). Note that some software repositories (communities) do not support searching for artifacts.
                        match_expression:
                          type: string
                          description: Search for all versions that match the community-specific expression. Should not be used together with `version`.
                          example: '> 1.3.4'
                        match_pattern:
                          type: string
                          description: Search for all versions that match the community-agnostic glob pattern. Should not be used together with `version`.
                          example: 1.*.*
      responses:
        oss-search:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/oss-search'
        bad-request:
          description: Bad request
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              examples:
                MalformedRequest:
                  value: Invalid structure of the request body
                UnsupportedParameter:
                  value: Invalid argument, the {purl_type} repository doesn't support artifact argument in the request.
        unauthorized:
          description: Not authorized
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              examples:
                NoToken:
                  value: Authentication credentials were not provided
                WrongToken:
                  value: Invalid token
        low-capacity:
          description: Insufficient remaining capacity
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Insufficient remaining capacity
        forbidden:
          description: Forbidden
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Forbidden
        content-too-large:
          description: Content too large
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Too many packages requested
        too-many-requests:
          description: Too many requests
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Too many requests
        server-error:
          description: Server error
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Internal server error
        not-found:
          description: Not found
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Not found
  /api/oss/community/v2/report/version/pkg:{repository}/{namespace}/{package}@{version}:
    get:
      summary: 'TCA-0701: Show report for a package version'
      tags:
        - Supply Chain Security
      description: |-
        Retrieve detailed information about a software package version specified in the request. The response contains the Spectra Assure Community analysis report for the requested package version. Only one package version can be specified per request.  

        To successfully retrieve the information, you must specify the correct purl (package URL) by using the required path parameters. The `version` part of the purl may be omitted. In that case, the API returns information about the latest published version of the software package.

        Optionally, you can specify the artifact file(s) for which you want to retrieve the information with query parameters `artifact` and `artifact_tag`. Note that these parameters work only with software repositories that support multiple version artifacts for software packages.
      operationId: getCommunityVersionAssessment
      parameters:
        - $ref: '#/components/parameters/purl_repository'
        - $ref: '#/components/parameters/purl_namespace'
        - $ref: '#/components/parameters/purl_package'
        - $ref: '#/components/parameters/purl_version'
        - $ref: '#/components/parameters/purl_artifact'
        - $ref: '#/components/parameters/purl_artifact_tag'
      responses:
        '200':
          $ref: '#/components/responses/oss-version'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '402':
          $ref: '#/components/responses/low-capacity'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/server-error'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/oss/community/v2/report/version/pkg:npm/@ampproject/remapping@2.3.0' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/oss/community/v2/report/version/pkg:npm/@ampproject/remapping@2.3.0"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    components:
      schemas:
        oss-version:
          type: object
          required:
            - community
          properties:
            community:
              description: Spectra Assure Community analysis report for a package version.
              type: object
              required:
                - report
              properties:
                report:
                  type: object
                  required:
                    - info
                  properties:
                    info:
                      type: object
                      required:
                        - file
                        - analysis
                      properties:
                        file:
                          $ref: '#/components/schemas/file'
                        analysis:
                          type: object
                          required:
                            - version
                            - timestamp
                          properties:
                            version:
                              type: string
                              description: Spectra Assure core analysis engine version.
                            timestamp:
                              type: string
                              description: Last package analysis time as ISO-8601 string.
                        statistics:
                          $ref: '#/components/schemas/statistics'
                        detections:
                          $ref: '#/components/schemas/detections'
                        disabled:
                          type: array
                          description: List of disabled policy checks.
                    metadata:
                      type: object
                      properties:
                        assessments:
                          $ref: '#/components/schemas/assessments'
                        incidents:
                          $ref: '#/components/schemas/incidents'
                        violations:
                          $ref: '#/components/schemas/violations'
                        indicators:
                          $ref: '#/components/schemas/indicators'
                        classifications:
                          $ref: '#/components/schemas/classifications'
                        vulnerabilities:
                          $ref: '#/components/schemas/vulnerabilities-2'
                        dependencies:
                          $ref: '#/components/schemas/dependencies'
        oss-package:
          type: object
          required:
            - community
          properties:
            community:
              type: object
              description: Spectra Assure Community analysis report for a package.
              allOf:
                - $ref: '#/components/schemas/package'
                - type: object
                  required:
                    - contributors
                  properties:
                    contributors:
                      $ref: '#/components/schemas/contributors'
        oss-search:
          type: object
          required:
            - community
          properties:
            community:
              type: object
              description: Results of a Spectra Assure Community search.
              required:
                - packages
              properties:
                packages:
                  type: array
                  description: One or more software packages that match the search criteria from the request.
                  items:
                    required:
                      - uuid
                      - package
                    properties:
                      uuid:
                        $ref: '#/components/schemas/uuid'
                      package:
                        $ref: '#/components/schemas/package'
                errors:
                  type: array
                  items:
                    required:
                      - uuid
                      - error
                    properties:
                      uuid:
                        $ref: '#/components/schemas/uuid'
                      error:
                        type: object
                        description: Package lookup error information.
                        required:
                          - code
                          - info
                        properties:
                          code:
                            type: integer
                            description: Package lookup HTTP error code.
                          info:
                            type: string
                            description: Package lookup HTTP error code description.
        uuid:
          type: string
          description: Unique, user-provided search identifier tied to each search query. The server returns this identifier in the response.
          example: 12-01
        communities:
          type: string
          enum:
            - npm
            - pypi
            - gem
            - nuget
            - vsx
            - psgallery
          description: Open source community identifier of the software repository that hosts the requested software package. Must match one of the [software repositories](https://docs.secure.software/community/#supported-communities) supported by Spectra Assure Community.
          example: npm
        identity:
          type: object
          required:
            - purl
            - community
            - namespace
            - package
            - product
            - version
            - artifact
            - license
            - published
            - deprecated
            - removed
            - category
            - homepage
            - repository
            - description
          properties:
            purl:
              type: string
              description: Fully qualified software package URL (including the artifact reference).
              example: pkg:npm/mock_react@19.0.0
            community:
              $ref: '#/components/schemas/communities'
            namespace:
              type: string
              description: Namespace of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: ''
            package:
              type: string
              description: Name of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: mock_react
            product:
              type: string
              description: Product name as declared by the publisher.
              example: Mock React
            version:
              type: string
              nullable: true
              description: Version of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: 19.0.0
            artifact:
              type: string
              nullable: true
              description: Artifact file name (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: ''
            license:
              type: string
              description: 'Package license as the SPDX license expression. The format is ReversingLabs-specific: LicenseFamily (SPDX-expression).'
              example: MIT
            published:
              type: string
              description: Package version publication date as ISO-8601 string.
              example: 2024-12-05T18:10:21+0000
            deprecated:
              type: boolean
              nullable: true
              description: Indicates if the version has been deprecated. Can be null if information is not available.
              example: false
            removed:
              type: boolean
              description: Indicates if the version has been removed.
              example: false
            category:
              type: string
              nullable: true
              description: Indicates the software category for the package version. Can be null if information is not available.
              example: ''
            homepage:
              type: string
              description: Package homepage or related website.
              example: www.example.com
            repository:
              type: string
              description: Source code related to the package.
              example: https://github.com/facebook/react
            description:
              type: string
              description: Package description as declared by the publisher.
              example: Mock React package for testing purposes.
            keywords:
              type: array
              description: Keywords associated with the software package.
        impl_quality:
          type: object
          required:
            - status
            - priority
            - assessment
          properties:
            status:
              type: string
              enum:
                - fail
                - warning
                - pass
              description: Overall package risk assessment evaluation result/status.
            priority:
              type: integer
              description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest). Optional.
              nullable: true
            assessment:
              type: string
              description: Overall package deployment risk.
            metrics:
              type: object
              description: Software quality metrics.
              required:
                - high
                - medium
                - low
              properties:
                high:
                  type: integer
                  description: Total number of policy violations with high severity on components.
                medium:
                  type: integer
                  description: Total number of policy violations with medium severity on components.
                low:
                  type: integer
                  description: Total number of policy violations with low severity on components.
        impl_artifacts:
          type: array
          items:
            type: object
            description: Artifacts related to the package version.
            required:
              - type
              - ref
            properties:
              type:
                type: string
                enum:
                  - linked-package
                  - rl-sbom-cyclonedx
                  - rl-sbom-spdx
                  - rl-safe
                description: Package artifact type. Linked packages are found in the package repository. RL packages are Spectra Assure generated artifacts. They might not be available for all packages or package versions.
                example: linked-package
              ref:
                type: string
                description: Package artifact reference. Linked packages use file names as references. RL packages use SHA-256 hashes as references.
                example: mock-1.22.4-.tar.gz'
        impl_assessment:
          type: object
          required:
            - final
            - enabled
            - status
            - priority
            - label
            - violations
            - count
          properties:
            final:
              type: boolean
              description: Risk is considered deciding when the final value is set to true.
            enabled:
              type: boolean
              description: Indicates that the risk assessment was performed during analysis. Spectra Assure license determines which risk assessments are performed.
            status:
              type: string
              enum:
                - fail
                - warning
                - pass
              description: Risk assessment evaluation result/status.
            priority:
              type: integer
              description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest). Optional.
              nullable: true
            label:
              type: string
              description: Risk assessment label to be displayed to the user.
            violations:
              type: array
              description: Policy violations that have caused the reported risk.
              items:
                type: string
            count:
              type: integer
              description: Number of risk associated with the risk label.
        assessments:
          type: object
          required:
            - licenses
            - malware
            - hardening
            - secrets
            - tampering
            - vulnerabilities
          properties:
            licenses:
              $ref: '#/components/schemas/impl_assessment'
            malware:
              $ref: '#/components/schemas/impl_assessment'
            hardening:
              $ref: '#/components/schemas/impl_assessment'
            secrets:
              $ref: '#/components/schemas/impl_assessment'
            tampering:
              $ref: '#/components/schemas/impl_assessment'
            vulnerabilities:
              $ref: '#/components/schemas/impl_assessment'
            repository:
              $ref: '#/components/schemas/impl_assessment'
        incidents:
          type: object
          additionalProperties:
            type: object
            required:
              - type
              - reporters
            properties:
              type:
                type: string
                enum:
                  - malware
                  - removal
                description: Describes the type of the incident.
              reporters:
                type: array
                items:
                  type: object
                  required:
                    - type
                    - name
                    - date
                    - link
                  properties:
                    type:
                      type: string
                      enum:
                        - rl-analyst
                        - rl-scanner
                        - community
                      description: Incident reporter. Differentiates between analysts, automated reporting, and community contributions.
                    name:
                      type: string
                      description: Incident reporter name. Name is displayed to the user within the UI.
                    date:
                      type: string
                      description: Incident date as ISO-8601 string.
                    link:
                      type: string
                      description: Link to a resource that contains more information on the incident. Value is optional.
        impl_versions:
          type: array
          items:
            type: object
            description: List of package versions and their most important details.
            required:
              - version
              - published
              - incidents
            properties:
              version:
                type: string
                description: Package version.
                example: 19.0.0
              published:
                type: string
                description: Package version publication date as ISO-8601 string.
                example: 2024-12-05T18:10:21+0000
              quality:
                $ref: '#/components/schemas/impl_quality'
              artifacts:
                $ref: '#/components/schemas/impl_artifacts'
              assessments:
                $ref: '#/components/schemas/assessments'
              incidents:
                $ref: '#/components/schemas/incidents'
        impl_incidents:
          type: object
          description: Statistics for incidents reported for any package version.
          required:
            - malware
            - recent_malware
            - removal
            - recent_removal
          properties:
            malware:
              type: integer
              description: Total number of malware incidents reported for the package.
              example: 0
            recent_malware:
              type: object
              description: Describes malware incidents.
              required:
                - latest_version
                - latest_timestamp
                - recent_count
              properties:
                latest_version:
                  type: string
                  description: The latest malware package version.
                latest_timestamp:
                  type: string
                  description: The time when the latest malware version was published as ISO-8601 string.
                recent_count:
                  type: integer
                  description: The number of malware incidents in the last two years.
            removal:
              type: integer
              description: Total number of removal incidents reported for the package.
              example: 1
            recent_removal:
              type: object
              description: Describes removal incidents.
              required:
                - latest_version
                - latest_timestamp
                - recent_count
              properties:
                latest_version:
                  type: string
                  description: The latest removed package version.
                  example: 1.2.0rc1
                latest_timestamp:
                  type: string
                  description: The time when the latest package removal occurred as ISO-8601 string.
                  example: 2020-05-14T11:25:54+0000
                recent_count:
                  type: integer
                  description: The number of removal incidents in the last two years.
                  example: 0
        package:
          type: object
          description: Software package metadata.
          required:
            - owner_verified
            - is_quarantined
            - first_published
            - total_versions
            - total_installs
            - total_downloads
            - latest_version
            - direct_imports
            - all_malicious
            - was_archived
            - was_removed
            - key_project
            - popularity
            - identity
            - versions
            - incidents
          properties:
            owner_verified:
              type: boolean
              description: Indicates that package ownership was verified by the package repository.
              example: false
            is_quarantined:
              type: boolean
              description: Indicates that the package may be quarantined in the package repository.
              nullable: true
            first_published:
              type: string
              description: Initial package publication date as ISO-8601 string.
              example: 2022-04-26T18:40:14+0000
            total_versions:
              type: integer
              description: Total number of currently published package/extension versions.
              example: 7
            total_installs:
              type: integer
              description: Total number of package/extension installations as tracked by the package repository.
              nullable: true
            total_downloads:
              type: integer
              description: Total number of package/extension downloads as tracked by the package repository.
              nullable: true
              example: 6231
            latest_version:
              type: string
              description: Latest published package version.
              example: 7.0.0
            direct_imports:
              type: integer
              description: Total number of other packages in the repository that directly import this one.
              nullable: true
              example: 312
            all_malicious:
              type: boolean
              description: Indicates that currently all package versions are reported as malware.
              example: false
            was_archived:
              type: boolean
              description: Indicates that the package may be archived in the package repository.
              nullable: true
            was_removed:
              type: boolean
              description: Indicates that the package was completely removed from the package repository.
              example: false
            key_project:
              type: boolean
              description: Indicates that the package is considered to be a key project in the community.
              example: false
            popularity:
              type: integer
              enum:
                - 10
                - 100
                - 1000
                - 10000
              description: Package ranking in the community based on the number of downloads.
              example: 1000
              nullable: true
            identity:
              $ref: '#/components/schemas/identity'
            versions:
              $ref: '#/components/schemas/impl_versions'
            incidents:
              $ref: '#/components/schemas/impl_incidents'
        oss-error:
          type: object
          required:
            - error
          properties:
            error:
              type: string
        hashes:
          type: array
          items:
            type: string
        file:
          type: object
          description: Details about the software package file.
          required:
            - name
            - size
            - source_url
            - downloaded
            - hashes
          properties:
            name:
              type: string
              description: Package artifact file name.
            size:
              type: integer
              description: Package artifact size in bytes.
            source_url:
              type: string
              description: Location of the package artifact in the remote repository.
            downloaded:
              type: boolean
              description: Indicates that the package has been successfully downloaded from the repository.
            hashes:
              type: array
              items:
                $ref: '#/components/schemas/hashes'
            identity:
              $ref: '#/components/schemas/identity'
        license:
          type: object
          description: Discovered license statistics.
          required:
            - undeclared
            - public_domain
            - permissive
            - weak_copyleft
            - copyleft
            - freeware
            - shareware
            - freemium
            - non_commercial
            - proprietary
          properties:
            undeclared:
              type: integer
              description: Number of software components and dependencies without a declared license.
            public_domain:
              type: integer
              description: Number of public domain software licenses.
            permissive:
              type: integer
              description: Number of permissive software licenses.
            weak_copyleft:
              type: integer
              description: Number of weak copyleft software licenses.
            copyleft:
              type: integer
              description: Number of copyleft software licenses.
            freeware:
              type: integer
              description: Number of freeware software licenses.
            shareware:
              type: integer
              description: Number of shareware software licenses.
            freemium:
              type: integer
              description: Number of freemium software licenses.
            non_commercial:
              type: integer
              description: Number of non-commercial software licenses.
            proprietary:
              type: integer
              description: Number of proprietary software licenses.
        vulnerabilities:
          type: object
          description: Discovered vulnerability statistics.
          properties:
            total:
              type: integer
              description: Total number of detected vulnerabilities.
            critical:
              type: integer
              description: Total number of critical severity vulnerabilities.
            high:
              type: integer
              description: Total number of high severity vulnerabilities.
            medium:
              type: integer
              description: Total number of medium severity vulnerabilities.
            low:
              type: integer
              description: Total number of low severity vulnerabilities.
            exploit:
              type: integer
              description: Number of vulnerabilities that have a known exploit.
            malware:
              type: integer
              description: Number of vulnerabilities that are exploited by malware.
            mandate:
              type: integer
              description: Number of vulnerabilities that are patching-mandated.
            fixable:
              type: integer
              description: Number of vulnerabilities that can be resolved by a package version update.
            named:
              type: integer
              description: Number of vulnerabilities that have distinguished marketing names.
        quality:
          type: object
          description: Overall software quality metrics.
          required:
            - status
            - priority
            - metrics
          properties:
            status:
              type: string
              enum:
                - fail
                - pass
              description: Overall software package policy evaluation result.
            priority:
              type: integer
              description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest).
            metrics:
              type: object
              description: Software quality metrics.
              required:
                - total
                - pass
                - warning
                - fail
                - high
                - medium
                - low
              properties:
                total:
                  type: integer
                  description: Total number of policy violations on components.
                pass:
                  type: integer
                  description: Total number of policy violations that passed on components.
                warning:
                  type: integer
                  description: Total number of policy violations that caused a warning on components.
                fail:
                  type: integer
                  description: Total number of policy violations that caused a failure on components.
                high:
                  type: integer
                  description: Total number of policy violations with high severity on components.
                medium:
                  type: integer
                  description: Total number of policy violations with medium severity on components.
                low:
                  type: integer
                  description: Total number of policy violations with low severity on components.
        statistics:
          type: object
          properties:
            components:
              type: integer
              description: Number of software components discovered during Spectra Assure analysis.
            dependencies:
              type: integer
              description: Number of software dependencies discovered during Spectra Assure analysis.
            extracted:
              type: integer
              description: Number of artifacts extracted during Spectra Assure analysis.
            license:
              $ref: '#/components/schemas/license'
            vulnerabilities:
              $ref: '#/components/schemas/vulnerabilities'
            quality:
              $ref: '#/components/schemas/quality'
        detections:
          type: object
          description: File classification results.
          additionalProperties:
            type: object
            description: Detected threat type if any. 'No Threats Detected' used for Goodware and Unknown results.
            additionalProperties:
              type: integer
              description: Number of files that were detected as threats.
          example:
            Goodware:
              No Threats Detected: 19
            Malicious:
              Downloader: 1
        violations:
          type: object
          additionalProperties:
            type: object
            required:
              - rule_id
              - status
              - priority
              - severity
              - category
              - description
              - statistics
            properties:
              rule_id:
                type: string
                description: 'Unique policy identifier. A four digit number prefixed by a type identifier: SQ (software quality) or TH (threat hunting).'
              status:
                type: string
                enum:
                  - fail
                  - warning
                  - pass
                description: Policy evaluation result/status.
              priority:
                type: integer
                enum:
                  - 0
                  - 1
                  - 2
                  - 3
                  - 4
                description: Recommended policy violation fix priority. Range from P0 (highest) to P4 (lowest).
              severity:
                type: string
                enum:
                  - high
                  - medium
                  - low
                description: Severity/impact of the matching policy.
              category:
                type: string
                description: Category of the matching policy.
              description:
                type: string
                description: Display label for the matching policy.
              statistics:
                type: object
                required:
                  - applicable
                  - enforcements
                  - exclusions
                  - violations
                properties:
                  applicable:
                    type: integer
                    description: Number of files that the policy can be applied to.
                  enforcements:
                    type: integer
                    description: Number of files that have failed due to the policy match.
                  exclusions:
                    type: integer
                    description: Number of files that have an excluded policy match.
                  violations:
                    type: integer
                    description: Number of files that have the policy match.
        indicators:
          type: object
          additionalProperties:
            type: object
            required:
              - rule_id
              - priority
              - category
              - description
              - exclusions
              - occurrences
              - violations
            properties:
              rule_id:
                type: string
                description: 'Unique behavior identifier. A four digit number prefixed by a type identifier: BH (behavior).'
              priority:
                type: integer
                description: Helps order behaviors for display. More impactful behaviors have a higher priority value.
              category:
                type: string
                description: Category that best describes the behavior.
              description:
                type: string
                description: Human-readable behavior description.
              exclusions:
                type: integer
                description: Number of files that have an excluded behavior match.
              occurrences:
                type: integer
                description: Number of files that have exhibit this behavior.
              violations:
                type: integer
                description: Number of files that have failed due to the behavior presence.
        classifications:
          type: array
          items:
            type: object
            required:
              - status
              - result
            properties:
              status:
                type: string
                enum:
                  - Malicious
                  - Suspicious
                description: File classification.
              result:
                type: string
                description: Fully qualified threat name. String validation can be done with the ReversingLabs Malware Naming Standard.
              hashes:
                type: array
                items:
                  $ref: '#/components/schemas/hashes'
        vulnerabilities-2:
          type: object
          additionalProperties:
            type: object
            required:
              - name
              - cvss
              - updated
              - affects
              - audit
              - exploit
            properties:
              name:
                type: string
                description: Popular vulnerability name. Usually used by media or marketing departments.
              cvss:
                type: object
                required:
                  - version
                  - baseScore
                properties:
                  version:
                    type: integer
                    description: CVSS schema version.
                  baseScore:
                    type: number
                    format: float
                    description: CVSS base score.
              updated:
                type: string
                description: Last vulnerability database update timestamp as ISO-8601 string.
              affects:
                type: array
                description: List of dependency PURLs affected by this vulnerability. For non-declared dependencies value 'non-manifest-component' is used.
              audit:
                type: object
                required:
                  - author
                  - timestamp
                  - reason
                properties:
                  author:
                    type: string
                    description: When vulnerabilities are triaged the audit record is populated to track who triaged the vulnerability.
                  timestamp:
                    type: string
                    description: When vulnerabilities are triaged the audit record is populated to track when vulnerability was triaged. Timestamp is a ISO-8601 string.
                  reason:
                    type: string
                    description: When vulnerabilities are triaged the audit record is populated to track the reason why the triage was performed. User-provided reason.
              exploit:
                type: array
                description: List of tags that describe the vulnerability.
                items:
                  type: string
                  enum:
                    - UNKNOWN
                    - EXISTS
                    - MALWARE
                    - MANDATE
                    - FIXABLE
                    - TRIAGED
        dependencies:
          type: object
          additionalProperties:
            type: object
            required:
              - type
              - purl
              - community
              - framework
              - product
              - version
              - license
              - vulnerabilities
            properties:
              type:
                type: string
                enum:
                  - package
                  - extension
                description: Software dependency declared by the package repository.
              purl:
                type: string
                description: Fully qualified package identifier (including the artifact reference)
              community:
                type: string
                enum:
                  - managed
                  - python
                  - java
                  - ruby
                  - nodejs
                  - vscode
                  - powershell
                description: OSS community in which the dependency is published.
              framework:
                type: string
                description: Defines the framework requirements needed to run the dependency. Currently only for .NET/managed community use.
              product:
                type: string
                description: Product name as declared by the publisher.
              version:
                type: string
                description: PURL - version from pkg:community/namespace/package@version
              license:
                type: string
                description: 'Package license as the SPDX license expression. The format is ReversingLabs-specific: LicenseFamily (SPDX-expression).'
              vulnerabilities:
                type: array
                description: List of CVEs that were detected to affect the dependency.
        contributors:
          type: array
          items:
            type: object
            description: List of package contributor roles and people related to the project.
            required:
              - role
              - name
              - user
              - email
            properties:
              role:
                type: string
                enum:
                  - developer
                  - maintainer
                  - author
                  - contributor
                  - owner
                description: Project contributor role.
              name:
                type: string
                description: Display name of the account associated with the contributor in the package repository.
              user:
                type: string
                description: User name of the account associated with the contributor in the package repository.
              email:
                type: string
                description: E-mail account associated with the contributor in the package repository.
      parameters:
        purl_repository:
          name: repository
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/communities'
        purl_namespace:
          name: namespace
          in: path
          description: Namespace of the requested software package (according to the purl schema `pkg:repository/namespace/package@version`).
          required: false
          example: '@ampproject'
          schema:
            type: string
        purl_package:
          name: package
          in: path
          description: Name of the requested software package (according to the purl schema `pkg:repository/namespace/package@version`).
          required: true
          example: remapping
          schema:
            type: string
        purl_version:
          name: version
          in: path
          description: Version of the requested software package (according to the purl schema `pkg:repository/namespace/package@version`).
          required: false
          example: 2.3.0
          schema:
            type: string
        purl_artifact:
          name: artifact
          in: query
          description: Qualifier that specifies the artifact file of the requested software package (according to the purl schema `pkg:repository/namespace/package@version?artifact=filename.ext`). Note that some software repositories (communities) do not support searching for artifacts.
          required: false
          example: mock_numpy-2.2.0-.tar.gz
          schema:
            type: string
        purl_artifact_tag:
          name: artifact_tag
          in: query
          description: Qualifier that specifies the artifact file of the requested software package by a repository-specific tag (according to the purl schema `pkg:repository/namespace/package@version?artifact_tag=example_tag`). Note that some software repositories (communities) do not support searching for artifacts.
          required: false
          example: cp310-cp310-win_amd64
          schema:
            type: string
      responses:
        bad-request:
          description: Bad request
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              examples:
                MalformedRequest:
                  value: Invalid structure of the request body
                UnsupportedParameter:
                  value: Invalid argument, the {purl_type} repository doesn't support artifact argument in the request.
        unauthorized:
          description: Not authorized
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              examples:
                NoToken:
                  value: Authentication credentials were not provided
                WrongToken:
                  value: Invalid token
        low-capacity:
          description: Insufficient remaining capacity
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Insufficient remaining capacity
        forbidden:
          description: Forbidden
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Forbidden
        content-too-large:
          description: Content too large
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Too many packages requested
        too-many-requests:
          description: Too many requests
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Too many requests
        server-error:
          description: Server error
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Internal server error
        oss-version:
          description: Spectra Assure Community analysis report for a version
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/oss-version'
        not-found:
          description: Not found
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Not found
  /api/oss/community/v2/report/package/pkg:{repository}/{namespace}/{package}@{version}:
    get:
      summary: 'TCA-0701: Show details about a package'
      tags:
        - Supply Chain Security
      description: |-
        Retrieve detailed information about a software package specified in the request. By default, the response includes relevant package metadata and the information about the latest published version of the software package. 

        To include information about a specific package version in the response, you can use the `version` path parameter in the request. Multiple package versions can be targeted with optional query parameters `match_pattern` and `match_expression`. These parameters are mutually exclusive (cannot be used together in a single request) and incompatible with the `version` parameter.

        To successfully show the software package information, the purl (package URL) must be correctly specified by using the required path parameters.

        Optionally, you can specify the artifact file(s) for which you want to retrieve the information with query parameters `artifact` and `artifact_tag`. Note that these parameters work only with software repositories that support multiple version artifacts for software packages.
      operationId: getCommunityPackageMetadata
      parameters:
        - $ref: '#/components/parameters/purl_repository'
        - $ref: '#/components/parameters/purl_namespace'
        - $ref: '#/components/parameters/purl_package'
        - $ref: '#/components/parameters/purl_version'
        - $ref: '#/components/parameters/purl_artifact'
        - $ref: '#/components/parameters/purl_artifact_tag'
        - $ref: '#/components/parameters/match_pattern'
        - $ref: '#/components/parameters/match_expression'
        - $ref: '#/components/parameters/query_offset'
        - $ref: '#/components/parameters/query_limit'
      responses:
        '200':
          $ref: '#/components/responses/oss-package'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '402':
          $ref: '#/components/responses/low-capacity'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/server-error'
      x-codeSamples:
        - lang: bash
          source: |
            curl 'https://data.reversinglabs.com/api/oss/community/v2/report/package/pkg:npm/@ampproject/remapping@2.3.0' --user <username>:<password>
        - lang: Python
          source: |
            import requests
            url = "https://data.reversinglabs.com/api/oss/community/v2/report/package/pkg:npm/@ampproject/remapping@2.3.0"
            response = requests.get(url, auth=('username', 'password'))
            print(response.text)
    components:
      schemas:
        oss-version:
          type: object
          required:
            - community
          properties:
            community:
              description: Spectra Assure Community analysis report for a package version.
              type: object
              required:
                - report
              properties:
                report:
                  type: object
                  required:
                    - info
                  properties:
                    info:
                      type: object
                      required:
                        - file
                        - analysis
                      properties:
                        file:
                          $ref: '#/components/schemas/file'
                        analysis:
                          type: object
                          required:
                            - version
                            - timestamp
                          properties:
                            version:
                              type: string
                              description: Spectra Assure core analysis engine version.
                            timestamp:
                              type: string
                              description: Last package analysis time as ISO-8601 string.
                        statistics:
                          $ref: '#/components/schemas/statistics'
                        detections:
                          $ref: '#/components/schemas/detections'
                        disabled:
                          type: array
                          description: List of disabled policy checks.
                    metadata:
                      type: object
                      properties:
                        assessments:
                          $ref: '#/components/schemas/assessments'
                        incidents:
                          $ref: '#/components/schemas/incidents'
                        violations:
                          $ref: '#/components/schemas/violations'
                        indicators:
                          $ref: '#/components/schemas/indicators'
                        classifications:
                          $ref: '#/components/schemas/classifications'
                        vulnerabilities:
                          $ref: '#/components/schemas/vulnerabilities-2'
                        dependencies:
                          $ref: '#/components/schemas/dependencies'
        oss-package:
          type: object
          required:
            - community
          properties:
            community:
              type: object
              description: Spectra Assure Community analysis report for a package.
              allOf:
                - $ref: '#/components/schemas/package'
                - type: object
                  required:
                    - contributors
                  properties:
                    contributors:
                      $ref: '#/components/schemas/contributors'
        oss-search:
          type: object
          required:
            - community
          properties:
            community:
              type: object
              description: Results of a Spectra Assure Community search.
              required:
                - packages
              properties:
                packages:
                  type: array
                  description: One or more software packages that match the search criteria from the request.
                  items:
                    required:
                      - uuid
                      - package
                    properties:
                      uuid:
                        $ref: '#/components/schemas/uuid'
                      package:
                        $ref: '#/components/schemas/package'
                errors:
                  type: array
                  items:
                    required:
                      - uuid
                      - error
                    properties:
                      uuid:
                        $ref: '#/components/schemas/uuid'
                      error:
                        type: object
                        description: Package lookup error information.
                        required:
                          - code
                          - info
                        properties:
                          code:
                            type: integer
                            description: Package lookup HTTP error code.
                          info:
                            type: string
                            description: Package lookup HTTP error code description.
        uuid:
          type: string
          description: Unique, user-provided search identifier tied to each search query. The server returns this identifier in the response.
          example: 12-01
        communities:
          type: string
          enum:
            - npm
            - pypi
            - gem
            - nuget
            - vsx
            - psgallery
          description: Open source community identifier of the software repository that hosts the requested software package. Must match one of the [software repositories](https://docs.secure.software/community/#supported-communities) supported by Spectra Assure Community.
          example: npm
        identity:
          type: object
          required:
            - purl
            - community
            - namespace
            - package
            - product
            - version
            - artifact
            - license
            - published
            - deprecated
            - removed
            - category
            - homepage
            - repository
            - description
          properties:
            purl:
              type: string
              description: Fully qualified software package URL (including the artifact reference).
              example: pkg:npm/mock_react@19.0.0
            community:
              $ref: '#/components/schemas/communities'
            namespace:
              type: string
              description: Namespace of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: ''
            package:
              type: string
              description: Name of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: mock_react
            product:
              type: string
              description: Product name as declared by the publisher.
              example: Mock React
            version:
              type: string
              nullable: true
              description: Version of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: 19.0.0
            artifact:
              type: string
              nullable: true
              description: Artifact file name (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
              example: ''
            license:
              type: string
              description: 'Package license as the SPDX license expression. The format is ReversingLabs-specific: LicenseFamily (SPDX-expression).'
              example: MIT
            published:
              type: string
              description: Package version publication date as ISO-8601 string.
              example: 2024-12-05T18:10:21+0000
            deprecated:
              type: boolean
              nullable: true
              description: Indicates if the version has been deprecated. Can be null if information is not available.
              example: false
            removed:
              type: boolean
              description: Indicates if the version has been removed.
              example: false
            category:
              type: string
              nullable: true
              description: Indicates the software category for the package version. Can be null if information is not available.
              example: ''
            homepage:
              type: string
              description: Package homepage or related website.
              example: www.example.com
            repository:
              type: string
              description: Source code related to the package.
              example: https://github.com/facebook/react
            description:
              type: string
              description: Package description as declared by the publisher.
              example: Mock React package for testing purposes.
            keywords:
              type: array
              description: Keywords associated with the software package.
        impl_quality:
          type: object
          required:
            - status
            - priority
            - assessment
          properties:
            status:
              type: string
              enum:
                - fail
                - warning
                - pass
              description: Overall package risk assessment evaluation result/status.
            priority:
              type: integer
              description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest). Optional.
              nullable: true
            assessment:
              type: string
              description: Overall package deployment risk.
            metrics:
              type: object
              description: Software quality metrics.
              required:
                - high
                - medium
                - low
              properties:
                high:
                  type: integer
                  description: Total number of policy violations with high severity on components.
                medium:
                  type: integer
                  description: Total number of policy violations with medium severity on components.
                low:
                  type: integer
                  description: Total number of policy violations with low severity on components.
        impl_artifacts:
          type: array
          items:
            type: object
            description: Artifacts related to the package version.
            required:
              - type
              - ref
            properties:
              type:
                type: string
                enum:
                  - linked-package
                  - rl-sbom-cyclonedx
                  - rl-sbom-spdx
                  - rl-safe
                description: Package artifact type. Linked packages are found in the package repository. RL packages are Spectra Assure generated artifacts. They might not be available for all packages or package versions.
                example: linked-package
              ref:
                type: string
                description: Package artifact reference. Linked packages use file names as references. RL packages use SHA-256 hashes as references.
                example: mock-1.22.4-.tar.gz'
        impl_assessment:
          type: object
          required:
            - final
            - enabled
            - status
            - priority
            - label
            - violations
            - count
          properties:
            final:
              type: boolean
              description: Risk is considered deciding when the final value is set to true.
            enabled:
              type: boolean
              description: Indicates that the risk assessment was performed during analysis. Spectra Assure license determines which risk assessments are performed.
            status:
              type: string
              enum:
                - fail
                - warning
                - pass
              description: Risk assessment evaluation result/status.
            priority:
              type: integer
              description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest). Optional.
              nullable: true
            label:
              type: string
              description: Risk assessment label to be displayed to the user.
            violations:
              type: array
              description: Policy violations that have caused the reported risk.
              items:
                type: string
            count:
              type: integer
              description: Number of risk associated with the risk label.
        assessments:
          type: object
          required:
            - licenses
            - malware
            - hardening
            - secrets
            - tampering
            - vulnerabilities
          properties:
            licenses:
              $ref: '#/components/schemas/impl_assessment'
            malware:
              $ref: '#/components/schemas/impl_assessment'
            hardening:
              $ref: '#/components/schemas/impl_assessment'
            secrets:
              $ref: '#/components/schemas/impl_assessment'
            tampering:
              $ref: '#/components/schemas/impl_assessment'
            vulnerabilities:
              $ref: '#/components/schemas/impl_assessment'
            repository:
              $ref: '#/components/schemas/impl_assessment'
        incidents:
          type: object
          additionalProperties:
            type: object
            required:
              - type
              - reporters
            properties:
              type:
                type: string
                enum:
                  - malware
                  - removal
                description: Describes the type of the incident.
              reporters:
                type: array
                items:
                  type: object
                  required:
                    - type
                    - name
                    - date
                    - link
                  properties:
                    type:
                      type: string
                      enum:
                        - rl-analyst
                        - rl-scanner
                        - community
                      description: Incident reporter. Differentiates between analysts, automated reporting, and community contributions.
                    name:
                      type: string
                      description: Incident reporter name. Name is displayed to the user within the UI.
                    date:
                      type: string
                      description: Incident date as ISO-8601 string.
                    link:
                      type: string
                      description: Link to a resource that contains more information on the incident. Value is optional.
        impl_versions:
          type: array
          items:
            type: object
            description: List of package versions and their most important details.
            required:
              - version
              - published
              - incidents
            properties:
              version:
                type: string
                description: Package version.
                example: 19.0.0
              published:
                type: string
                description: Package version publication date as ISO-8601 string.
                example: 2024-12-05T18:10:21+0000
              quality:
                $ref: '#/components/schemas/impl_quality'
              artifacts:
                $ref: '#/components/schemas/impl_artifacts'
              assessments:
                $ref: '#/components/schemas/assessments'
              incidents:
                $ref: '#/components/schemas/incidents'
        impl_incidents:
          type: object
          description: Statistics for incidents reported for any package version.
          required:
            - malware
            - recent_malware
            - removal
            - recent_removal
          properties:
            malware:
              type: integer
              description: Total number of malware incidents reported for the package.
              example: 0
            recent_malware:
              type: object
              description: Describes malware incidents.
              required:
                - latest_version
                - latest_timestamp
                - recent_count
              properties:
                latest_version:
                  type: string
                  description: The latest malware package version.
                latest_timestamp:
                  type: string
                  description: The time when the latest malware version was published as ISO-8601 string.
                recent_count:
                  type: integer
                  description: The number of malware incidents in the last two years.
            removal:
              type: integer
              description: Total number of removal incidents reported for the package.
              example: 1
            recent_removal:
              type: object
              description: Describes removal incidents.
              required:
                - latest_version
                - latest_timestamp
                - recent_count
              properties:
                latest_version:
                  type: string
                  description: The latest removed package version.
                  example: 1.2.0rc1
                latest_timestamp:
                  type: string
                  description: The time when the latest package removal occurred as ISO-8601 string.
                  example: 2020-05-14T11:25:54+0000
                recent_count:
                  type: integer
                  description: The number of removal incidents in the last two years.
                  example: 0
        package:
          type: object
          description: Software package metadata.
          required:
            - owner_verified
            - is_quarantined
            - first_published
            - total_versions
            - total_installs
            - total_downloads
            - latest_version
            - direct_imports
            - all_malicious
            - was_archived
            - was_removed
            - key_project
            - popularity
            - identity
            - versions
            - incidents
          properties:
            owner_verified:
              type: boolean
              description: Indicates that package ownership was verified by the package repository.
              example: false
            is_quarantined:
              type: boolean
              description: Indicates that the package may be quarantined in the package repository.
              nullable: true
            first_published:
              type: string
              description: Initial package publication date as ISO-8601 string.
              example: 2022-04-26T18:40:14+0000
            total_versions:
              type: integer
              description: Total number of currently published package/extension versions.
              example: 7
            total_installs:
              type: integer
              description: Total number of package/extension installations as tracked by the package repository.
              nullable: true
            total_downloads:
              type: integer
              description: Total number of package/extension downloads as tracked by the package repository.
              nullable: true
              example: 6231
            latest_version:
              type: string
              description: Latest published package version.
              example: 7.0.0
            direct_imports:
              type: integer
              description: Total number of other packages in the repository that directly import this one.
              nullable: true
              example: 312
            all_malicious:
              type: boolean
              description: Indicates that currently all package versions are reported as malware.
              example: false
            was_archived:
              type: boolean
              description: Indicates that the package may be archived in the package repository.
              nullable: true
            was_removed:
              type: boolean
              description: Indicates that the package was completely removed from the package repository.
              example: false
            key_project:
              type: boolean
              description: Indicates that the package is considered to be a key project in the community.
              example: false
            popularity:
              type: integer
              enum:
                - 10
                - 100
                - 1000
                - 10000
              description: Package ranking in the community based on the number of downloads.
              example: 1000
              nullable: true
            identity:
              $ref: '#/components/schemas/identity'
            versions:
              $ref: '#/components/schemas/impl_versions'
            incidents:
              $ref: '#/components/schemas/impl_incidents'
        oss-error:
          type: object
          required:
            - error
          properties:
            error:
              type: string
        hashes:
          type: array
          items:
            type: string
        file:
          type: object
          description: Details about the software package file.
          required:
            - name
            - size
            - source_url
            - downloaded
            - hashes
          properties:
            name:
              type: string
              description: Package artifact file name.
            size:
              type: integer
              description: Package artifact size in bytes.
            source_url:
              type: string
              description: Location of the package artifact in the remote repository.
            downloaded:
              type: boolean
              description: Indicates that the package has been successfully downloaded from the repository.
            hashes:
              type: array
              items:
                $ref: '#/components/schemas/hashes'
            identity:
              $ref: '#/components/schemas/identity'
        license:
          type: object
          description: Discovered license statistics.
          required:
            - undeclared
            - public_domain
            - permissive
            - weak_copyleft
            - copyleft
            - freeware
            - shareware
            - freemium
            - non_commercial
            - proprietary
          properties:
            undeclared:
              type: integer
              description: Number of software components and dependencies without a declared license.
            public_domain:
              type: integer
              description: Number of public domain software licenses.
            permissive:
              type: integer
              description: Number of permissive software licenses.
            weak_copyleft:
              type: integer
              description: Number of weak copyleft software licenses.
            copyleft:
              type: integer
              description: Number of copyleft software licenses.
            freeware:
              type: integer
              description: Number of freeware software licenses.
            shareware:
              type: integer
              description: Number of shareware software licenses.
            freemium:
              type: integer
              description: Number of freemium software licenses.
            non_commercial:
              type: integer
              description: Number of non-commercial software licenses.
            proprietary:
              type: integer
              description: Number of proprietary software licenses.
        vulnerabilities:
          type: object
          description: Discovered vulnerability statistics.
          properties:
            total:
              type: integer
              description: Total number of detected vulnerabilities.
            critical:
              type: integer
              description: Total number of critical severity vulnerabilities.
            high:
              type: integer
              description: Total number of high severity vulnerabilities.
            medium:
              type: integer
              description: Total number of medium severity vulnerabilities.
            low:
              type: integer
              description: Total number of low severity vulnerabilities.
            exploit:
              type: integer
              description: Number of vulnerabilities that have a known exploit.
            malware:
              type: integer
              description: Number of vulnerabilities that are exploited by malware.
            mandate:
              type: integer
              description: Number of vulnerabilities that are patching-mandated.
            fixable:
              type: integer
              description: Number of vulnerabilities that can be resolved by a package version update.
            named:
              type: integer
              description: Number of vulnerabilities that have distinguished marketing names.
        quality:
          type: object
          description: Overall software quality metrics.
          required:
            - status
            - priority
            - metrics
          properties:
            status:
              type: string
              enum:
                - fail
                - pass
              description: Overall software package policy evaluation result.
            priority:
              type: integer
              description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest).
            metrics:
              type: object
              description: Software quality metrics.
              required:
                - total
                - pass
                - warning
                - fail
                - high
                - medium
                - low
              properties:
                total:
                  type: integer
                  description: Total number of policy violations on components.
                pass:
                  type: integer
                  description: Total number of policy violations that passed on components.
                warning:
                  type: integer
                  description: Total number of policy violations that caused a warning on components.
                fail:
                  type: integer
                  description: Total number of policy violations that caused a failure on components.
                high:
                  type: integer
                  description: Total number of policy violations with high severity on components.
                medium:
                  type: integer
                  description: Total number of policy violations with medium severity on components.
                low:
                  type: integer
                  description: Total number of policy violations with low severity on components.
        statistics:
          type: object
          properties:
            components:
              type: integer
              description: Number of software components discovered during Spectra Assure analysis.
            dependencies:
              type: integer
              description: Number of software dependencies discovered during Spectra Assure analysis.
            extracted:
              type: integer
              description: Number of artifacts extracted during Spectra Assure analysis.
            license:
              $ref: '#/components/schemas/license'
            vulnerabilities:
              $ref: '#/components/schemas/vulnerabilities'
            quality:
              $ref: '#/components/schemas/quality'
        detections:
          type: object
          description: File classification results.
          additionalProperties:
            type: object
            description: Detected threat type if any. 'No Threats Detected' used for Goodware and Unknown results.
            additionalProperties:
              type: integer
              description: Number of files that were detected as threats.
          example:
            Goodware:
              No Threats Detected: 19
            Malicious:
              Downloader: 1
        violations:
          type: object
          additionalProperties:
            type: object
            required:
              - rule_id
              - status
              - priority
              - severity
              - category
              - description
              - statistics
            properties:
              rule_id:
                type: string
                description: 'Unique policy identifier. A four digit number prefixed by a type identifier: SQ (software quality) or TH (threat hunting).'
              status:
                type: string
                enum:
                  - fail
                  - warning
                  - pass
                description: Policy evaluation result/status.
              priority:
                type: integer
                enum:
                  - 0
                  - 1
                  - 2
                  - 3
                  - 4
                description: Recommended policy violation fix priority. Range from P0 (highest) to P4 (lowest).
              severity:
                type: string
                enum:
                  - high
                  - medium
                  - low
                description: Severity/impact of the matching policy.
              category:
                type: string
                description: Category of the matching policy.
              description:
                type: string
                description: Display label for the matching policy.
              statistics:
                type: object
                required:
                  - applicable
                  - enforcements
                  - exclusions
                  - violations
                properties:
                  applicable:
                    type: integer
                    description: Number of files that the policy can be applied to.
                  enforcements:
                    type: integer
                    description: Number of files that have failed due to the policy match.
                  exclusions:
                    type: integer
                    description: Number of files that have an excluded policy match.
                  violations:
                    type: integer
                    description: Number of files that have the policy match.
        indicators:
          type: object
          additionalProperties:
            type: object
            required:
              - rule_id
              - priority
              - category
              - description
              - exclusions
              - occurrences
              - violations
            properties:
              rule_id:
                type: string
                description: 'Unique behavior identifier. A four digit number prefixed by a type identifier: BH (behavior).'
              priority:
                type: integer
                description: Helps order behaviors for display. More impactful behaviors have a higher priority value.
              category:
                type: string
                description: Category that best describes the behavior.
              description:
                type: string
                description: Human-readable behavior description.
              exclusions:
                type: integer
                description: Number of files that have an excluded behavior match.
              occurrences:
                type: integer
                description: Number of files that have exhibit this behavior.
              violations:
                type: integer
                description: Number of files that have failed due to the behavior presence.
        classifications:
          type: array
          items:
            type: object
            required:
              - status
              - result
            properties:
              status:
                type: string
                enum:
                  - Malicious
                  - Suspicious
                description: File classification.
              result:
                type: string
                description: Fully qualified threat name. String validation can be done with the ReversingLabs Malware Naming Standard.
              hashes:
                type: array
                items:
                  $ref: '#/components/schemas/hashes'
        vulnerabilities-2:
          type: object
          additionalProperties:
            type: object
            required:
              - name
              - cvss
              - updated
              - affects
              - audit
              - exploit
            properties:
              name:
                type: string
                description: Popular vulnerability name. Usually used by media or marketing departments.
              cvss:
                type: object
                required:
                  - version
                  - baseScore
                properties:
                  version:
                    type: integer
                    description: CVSS schema version.
                  baseScore:
                    type: number
                    format: float
                    description: CVSS base score.
              updated:
                type: string
                description: Last vulnerability database update timestamp as ISO-8601 string.
              affects:
                type: array
                description: List of dependency PURLs affected by this vulnerability. For non-declared dependencies value 'non-manifest-component' is used.
              audit:
                type: object
                required:
                  - author
                  - timestamp
                  - reason
                properties:
                  author:
                    type: string
                    description: When vulnerabilities are triaged the audit record is populated to track who triaged the vulnerability.
                  timestamp:
                    type: string
                    description: When vulnerabilities are triaged the audit record is populated to track when vulnerability was triaged. Timestamp is a ISO-8601 string.
                  reason:
                    type: string
                    description: When vulnerabilities are triaged the audit record is populated to track the reason why the triage was performed. User-provided reason.
              exploit:
                type: array
                description: List of tags that describe the vulnerability.
                items:
                  type: string
                  enum:
                    - UNKNOWN
                    - EXISTS
                    - MALWARE
                    - MANDATE
                    - FIXABLE
                    - TRIAGED
        dependencies:
          type: object
          additionalProperties:
            type: object
            required:
              - type
              - purl
              - community
              - framework
              - product
              - version
              - license
              - vulnerabilities
            properties:
              type:
                type: string
                enum:
                  - package
                  - extension
                description: Software dependency declared by the package repository.
              purl:
                type: string
                description: Fully qualified package identifier (including the artifact reference)
              community:
                type: string
                enum:
                  - managed
                  - python
                  - java
                  - ruby
                  - nodejs
                  - vscode
                  - powershell
                description: OSS community in which the dependency is published.
              framework:
                type: string
                description: Defines the framework requirements needed to run the dependency. Currently only for .NET/managed community use.
              product:
                type: string
                description: Product name as declared by the publisher.
              version:
                type: string
                description: PURL - version from pkg:community/namespace/package@version
              license:
                type: string
                description: 'Package license as the SPDX license expression. The format is ReversingLabs-specific: LicenseFamily (SPDX-expression).'
              vulnerabilities:
                type: array
                description: List of CVEs that were detected to affect the dependency.
        contributors:
          type: array
          items:
            type: object
            description: List of package contributor roles and people related to the project.
            required:
              - role
              - name
              - user
              - email
            properties:
              role:
                type: string
                enum:
                  - developer
                  - maintainer
                  - author
                  - contributor
                  - owner
                description: Project contributor role.
              name:
                type: string
                description: Display name of the account associated with the contributor in the package repository.
              user:
                type: string
                description: User name of the account associated with the contributor in the package repository.
              email:
                type: string
                description: E-mail account associated with the contributor in the package repository.
      parameters:
        query_offset:
          name: offset
          in: query
          description: This optional parameter is used for pagination to specify the starting index when enumerating package versions in the response.
          required: false
          schema:
            type: integer
            default: 0
        query_limit:
          name: limit
          in: query
          description: Specify the maximum number of package versions to include in the response.
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 5
        purl_repository:
          name: repository
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/communities'
        purl_namespace:
          name: namespace
          in: path
          description: Namespace of the requested software package (according to the purl schema `pkg:repository/namespace/package@version`).
          required: false
          example: '@ampproject'
          schema:
            type: string
        purl_package:
          name: package
          in: path
          description: Name of the requested software package (according to the purl schema `pkg:repository/namespace/package@version`).
          required: true
          example: remapping
          schema:
            type: string
        purl_version:
          name: version
          in: path
          description: Version of the requested software package (according to the purl schema `pkg:repository/namespace/package@version`).
          required: false
          example: 2.3.0
          schema:
            type: string
        purl_artifact:
          name: artifact
          in: query
          description: Qualifier that specifies the artifact file of the requested software package (according to the purl schema `pkg:repository/namespace/package@version?artifact=filename.ext`). Note that some software repositories (communities) do not support searching for artifacts.
          required: false
          example: mock_numpy-2.2.0-.tar.gz
          schema:
            type: string
        purl_artifact_tag:
          name: artifact_tag
          in: query
          description: Qualifier that specifies the artifact file of the requested software package by a repository-specific tag (according to the purl schema `pkg:repository/namespace/package@version?artifact_tag=example_tag`). Note that some software repositories (communities) do not support searching for artifacts.
          required: false
          example: cp310-cp310-win_amd64
          schema:
            type: string
        match_pattern:
          name: match_pattern
          in: query
          description: Specifies the community-specific version glob pattern. Used for dependency resolution. Should not be used together with `version` or `match_expression`.
          required: false
          example: 1.3.*
          schema:
            type: string
        match_expression:
          name: match_expression
          in: query
          description: Specifies the community-specific version expression. Used for dependency resolution. Should not be used together with `version` or `match_pattern`.
          required: false
          example: <= 18.3.0
          schema:
            type: string
      responses:
        bad-request:
          description: Bad request
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              examples:
                MalformedRequest:
                  value: Invalid structure of the request body
                UnsupportedParameter:
                  value: Invalid argument, the {purl_type} repository doesn't support artifact argument in the request.
        unauthorized:
          description: Not authorized
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              examples:
                NoToken:
                  value: Authentication credentials were not provided
                WrongToken:
                  value: Invalid token
        low-capacity:
          description: Insufficient remaining capacity
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Insufficient remaining capacity
        forbidden:
          description: Forbidden
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Forbidden
        content-too-large:
          description: Content too large
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Too many packages requested
        too-many-requests:
          description: Too many requests
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Too many requests
        server-error:
          description: Server error
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Internal server error
        not-found:
          description: Not found
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/oss-error'
              example: Not found
        oss-package:
          description: Spectra Assure Community analysis report for a package
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/oss-package'
  /api/feed/supply_chain/ioc/v1/query/start:
    put:
      summary: 'TCF-0701: Indicators of Compromise (Start)'
      tags:
        - Supply Chain Security
      operationId: put-api-feed-supply-chain-ioc-v1-start
      description: |
        Starts the Supply Chain Indicators of Compromise (IoC) feed session and initializes access to structured threat intelligence data for malicious Open Source Software (OSS) packages. The feed stores events since 2011-03-29.
      responses:
        '200':
          description: Successfully started
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: Successfully started
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: ''
        - lang: Python
          source: ''
  /api/feed/supply_chain/ioc/v1/query/{time_format}/{time_value}:
    get:
      summary: 'TCF-0701: Indicators of Compromise (Get) (time range)'
      tags:
        - Supply Chain Security
      operationId: get-api-feed-supply-chain-ioc-v1-get
      description: |
        Retrieve feed data starting from a specific time. The Supply Chain Indicators of Compromise (IoC) service delivers access to large volumes of structured threat intelligence data for malicious Open Source Software (OSS) packages and subsequent reclassifications. The feed stores events since 2011-03-29.
      parameters:
        - name: time_format
          in: path
          required: true
          schema:
            type: string
            enum:
              - utc
              - timestamp
          description: |
            Format of the time value ('utc' or 'timestamp').
        - name: time_value
          in: path
          required: true
          schema:
            type: string
          description: |
            The time value corresponding to the given format.
        - name: format
          in: query
          required: false
          schema:
            type: string
            default: xml
            enum:
              - xml
              - json
          description: |
            Format of the response.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 1000
            minimum: 1
            maximum: 1000
          description: |
            Maximum number of results to be retrieved. Default is 1000.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      supply_chain_ioc_feed:
                        last_timestamp: string
                        time_range:
                          to: string
                          from: string
                        entries:
                          - event_type: NEW_MALICIOUS
                            md5: 99d1bdaaa2e4a198521bc12df599ead0
                            sha1: aad8d679f15a721ed79454d553e3473f9f0536f1
                            sha256: e37d30c42c9739dfe153a324885937cbb98ed31760d1ba34d5542b309b2a67b0
                            sha512: 11d11650fdc393da32c9c4733016d51d85b718b6eae4a3d61cb2a95d23700f917abb4b35c75da698fe0a233a924b3a6782ff3ff291377f8f7fa86046f1582a0a
                            filename: ua-parser-js-0.7.29.tgz
                            sample_size: '57690'
                            source_url: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.29.tgz
                            identity:
                              purl: pkg:npm/ua-parser-js@0.7.29
                              community: npm
                              package: ua-parser-js
                              version: 0.7.29
                              homepage: https://uaparser.dev
                              repository: https://github.com/faisalman/ua-parser-js
                              published: 2025-10-10T03:51:52+0000
                            sample_list:
                              - status: MALICIOUS
                                threat_name: Archive-GZIP.Downloader.SupplyChain
                                threat_level: '3'
                                md5: 99d1bdaaa2e4a198521bc12df599ead0
                                sha1: aad8d679f15a721ed79454d553e3473f9f0536f1
                                sha256: e37d30c42c9739dfe153a324885937cbb98ed31760d1ba34d5542b309b2a67b0
                              - status: MALICIOUS
                                threat_name: Script-BAT.Downloader.SupplyChain
                                threat_level: '3'
                                md5: d98a3013336b755b739d285a58528cbe
                                sha1: 01a2c9815acd76dc827b0325b97b793af3632c18
                                sha256: f4c800066e56dd32d20299c451fe6a2b60a3563f7f1915f8ca8db9916d810b5c
                              - status: MALICIOUS
                                threat_name: Text.Downloader.SupplyChain
                                threat_level: '3'
                                sha1: 8b242cf78d082e81b5432c19477ebb80e5cf291a
                                sha256: 82bd9d21a895327a17a7fd55d8c1270402bd0e5cf0443936be90d3738ce24560
                              - status: MALICIOUS
                                threat_name: Script-Shell.Downloader.SupplyChain
                                threat_level: '3'
                                md5: 13f840772c7c04c7d2f4c202ff957b0c
                                sha1: 69834f154ea070abccb8b08a10fd2da0bcc83543
                                sha256: 21e68b048024ba0cc5a2a94ecbc3a78c626ec7d5d705829a82ea4715131d0509
                              - status: MALICIOUS
                                threat_name: Archive-TAR.Downloader.SupplyChain
                                threat_level: '3'
                                md5: 9f5e525644662588972117c108b7ac03
                                sha1: 45888251d905bf928db70350717d9451daa60b8c
                                sha256: 44b01b5c634f93f2433e1796e8804c6ae4da966999d7539d5b8d62fe8c33d414
                              - status: MALICIOUS
                                threat_name: Script-JS.Downloader.SupplyChain
                                threat_level: '3'
                                md5: a4668a1b3f23b79ef07d1afe0152999e
                                sha1: 1b76d2622ee8729704c56f5f8942a75ab729047b
                                sha256: e6cba23d350cb1f049266ddf10f872216f193c5279017408b869539df2e73c83
                          - event_type: FP
                            md5: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
                            sha1: 1234567890abcdef1234567890abcdef12345678
                            sha256: abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890
                            sha512: 1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
                            filename: example-package-1.0.0.tgz
                            sample_size: '12345'
                            source_url: https://registry.npmjs.org/example-package/-/example-package-1.0.0.tgz
                            identity:
                              purl: pkg:npm/example-package@1.0.0
                              community: npm
                              package: example-package
                              version: 1.0.0
                              homepage: https://example.com
                              repository: https://github.com/example/example-package
                              published: 2025-06-15T10:30:00+0000
                            sample_list:
                              - status: KNOWN
                                threat_name: ''
                                threat_level: '0'
                                md5: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
                                sha1: 1234567890abcdef1234567890abcdef12345678
                                sha256: abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890
                          - event_type: NEW_THREAT_NAME
                            md5: b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5
                            sha1: 234567890abcdef1234567890abcdef123456789
                            sha256: bcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab
                            sha512: 234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef12
                            filename: threat-package-2.0.0.tgz
                            sample_size: '23456'
                            source_url: https://registry.npmjs.org/threat-package/-/threat-package-2.0.0.tgz
                            identity:
                              purl: pkg:npm/threat-package@2.0.0
                              community: npm
                              package: threat-package
                              version: 2.0.0
                              homepage: https://threat-example.com
                              repository: https://github.com/example/threat-package
                              published: 2025-07-20T14:45:00+0000
                            sample_list:
                              - status: MALICIOUS
                                threat_name: Script-JS.Trojan.SupplyChain
                                threat_level: '4'
                                md5: b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5
                                sha1: 234567890abcdef1234567890abcdef123456789
                                sha256: bcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      supply_chain_ioc_feed:
                        type: object
                        properties:
                          last_timestamp:
                            type: string
                            description: Timestamp of the last entry in the feed
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                                description: End time of the query range
                              from:
                                type: string
                                description: Start time of the query range
                          entries:
                            type: array
                            description: Array of supply chain IoC entries
                            items:
                              type: object
                              properties:
                                event_type:
                                  type: string
                                  description: Type of event
                                  enum:
                                    - NEW_MALICIOUS
                                    - FP
                                    - NEW_THREAT_NAME
                                md5:
                                  type: string
                                  description: MD5 hash of the package
                                sha1:
                                  type: string
                                  description: SHA1 hash of the package
                                sha256:
                                  type: string
                                  description: SHA256 hash of the package
                                sha512:
                                  type: string
                                  description: SHA512 hash of the package
                                filename:
                                  type: string
                                  description: Name of the package file
                                sample_size:
                                  type: string
                                  description: Size of the package in bytes
                                source_url:
                                  type: string
                                  description: URL where the package was downloaded from
                                identity:
                                  type: object
                                  description: Package identity information
                                  properties:
                                    purl:
                                      type: string
                                      description: Package URL identifier
                                    community:
                                      type: string
                                      description: Package community (e.g., npm, pypi)
                                    namespace:
                                      type: string
                                      description: Package namespace
                                    package:
                                      type: string
                                      description: Package name
                                    product:
                                      type: string
                                      description: Product name
                                    version:
                                      type: string
                                      description: Package version
                                    artifact:
                                      type: string
                                      description: Artifact identifier
                                    homepage:
                                      type: string
                                      description: Package homepage URL
                                    repository:
                                      type: string
                                      description: Package repository URL
                                    published:
                                      type: string
                                      description: Package publication timestamp
                                sample_list:
                                  type: array
                                  description: List of malicious samples found in the package
                                  items:
                                    type: object
                                    properties:
                                      status:
                                        type: string
                                        description: Sample status
                                        enum:
                                          - MALICIOUS
                                          - KNOWN
                                          - SUSPICIOUS
                                          - UNKNOWN
                                      threat_name:
                                        type: string
                                        description: Name of the detected threat
                                      threat_level:
                                        type: string
                                        description: Threat level (1-5)
                                        minimum: 1
                                        maximum: 5
                                      md5:
                                        type: string
                                        description: MD5 hash of the sample
                                      sha1:
                                        type: string
                                        description: SHA1 hash of the sample
                                      sha256:
                                        type: string
                                        description: SHA256 hash of the sample
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: ''
        - lang: Python
          source: ''
  /api/feed/supply_chain/ioc/v1/query/pull:
    get:
      summary: 'TCF-0701: Indicators of Compromise (Pull)'
      tags:
        - Supply Chain Security
      operationId: get-api-feed-supply-chain-ioc-v1-pull
      description: |
        The Supply Chain Indicators of Compromise (IoC) service delivers access to large volumes of structured threat intelligence data for malicious Open Source Software (OSS) packages and subsequent reclassifications. The feed stores events since 2011-03-29.
      parameters:
        - name: format
          in: query
          required: false
          schema:
            type: string
            default: xml
            enum:
              - xml
              - json
          description: |
            Format of the response.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 1000
            minimum: 1
            maximum: 1000
          description: |
            Maximum number of results to be retrieved. Default is 1000.
      responses:
        '200':
          description: The request has succeeded.
          headers: {}
          content:
            application/json:
              examples:
                example:
                  value:
                    rl:
                      supply_chain_ioc_feed:
                        last_timestamp: string
                        time_range:
                          to: string
                          from: string
                        entries:
                          - event_type: NEW_MALICIOUS
                            md5: 99d1bdaaa2e4a198521bc12df599ead0
                            sha1: aad8d679f15a721ed79454d553e3473f9f0536f1
                            sha256: e37d30c42c9739dfe153a324885937cbb98ed31760d1ba34d5542b309b2a67b0
                            sha512: 11d11650fdc393da32c9c4733016d51d85b718b6eae4a3d61cb2a95d23700f917abb4b35c75da698fe0a233a924b3a6782ff3ff291377f8f7fa86046f1582a0a
                            filename: ua-parser-js-0.7.29.tgz
                            sample_size: '57690'
                            source_url: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.29.tgz
                            identity:
                              purl: pkg:npm/ua-parser-js@0.7.29
                              community: npm
                              package: ua-parser-js
                              version: 0.7.29
                              homepage: https://uaparser.dev
                              repository: https://github.com/faisalman/ua-parser-js
                              published: 2025-10-10T03:51:52+0000
                            sample_list:
                              - status: MALICIOUS
                                threat_name: Archive-GZIP.Downloader.SupplyChain
                                threat_level: '3'
                                md5: 99d1bdaaa2e4a198521bc12df599ead0
                                sha1: aad8d679f15a721ed79454d553e3473f9f0536f1
                                sha256: e37d30c42c9739dfe153a324885937cbb98ed31760d1ba34d5542b309b2a67b0
                              - status: MALICIOUS
                                threat_name: Script-BAT.Downloader.SupplyChain
                                threat_level: '3'
                                md5: d98a3013336b755b739d285a58528cbe
                                sha1: 01a2c9815acd76dc827b0325b97b793af3632c18
                                sha256: f4c800066e56dd32d20299c451fe6a2b60a3563f7f1915f8ca8db9916d810b5c
                              - status: MALICIOUS
                                threat_name: Text.Downloader.SupplyChain
                                threat_level: '3'
                                sha1: 8b242cf78d082e81b5432c19477ebb80e5cf291a
                                sha256: 82bd9d21a895327a17a7fd55d8c1270402bd0e5cf0443936be90d3738ce24560
                              - status: MALICIOUS
                                threat_name: Script-Shell.Downloader.SupplyChain
                                threat_level: '3'
                                md5: 13f840772c7c04c7d2f4c202ff957b0c
                                sha1: 69834f154ea070abccb8b08a10fd2da0bcc83543
                                sha256: 21e68b048024ba0cc5a2a94ecbc3a78c626ec7d5d705829a82ea4715131d0509
                              - status: MALICIOUS
                                threat_name: Archive-TAR.Downloader.SupplyChain
                                threat_level: '3'
                                md5: 9f5e525644662588972117c108b7ac03
                                sha1: 45888251d905bf928db70350717d9451daa60b8c
                                sha256: 44b01b5c634f93f2433e1796e8804c6ae4da966999d7539d5b8d62fe8c33d414
                              - status: MALICIOUS
                                threat_name: Script-JS.Downloader.SupplyChain
                                threat_level: '3'
                                md5: a4668a1b3f23b79ef07d1afe0152999e
                                sha1: 1b76d2622ee8729704c56f5f8942a75ab729047b
                                sha256: e6cba23d350cb1f049266ddf10f872216f193c5279017408b869539df2e73c83
                          - event_type: FP
                            md5: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
                            sha1: 1234567890abcdef1234567890abcdef12345678
                            sha256: abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890
                            sha512: 1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
                            filename: example-package-1.0.0.tgz
                            sample_size: '12345'
                            source_url: https://registry.npmjs.org/example-package/-/example-package-1.0.0.tgz
                            identity:
                              purl: pkg:npm/example-package@1.0.0
                              community: npm
                              package: example-package
                              version: 1.0.0
                              homepage: https://example.com
                              repository: https://github.com/example/example-package
                              published: 2025-06-15T10:30:00+0000
                            sample_list:
                              - status: KNOWN
                                threat_name: ''
                                threat_level: '0'
                                md5: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
                                sha1: 1234567890abcdef1234567890abcdef12345678
                                sha256: abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890
                          - event_type: NEW_THREAT_NAME
                            md5: b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5
                            sha1: 234567890abcdef1234567890abcdef123456789
                            sha256: bcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab
                            sha512: 234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef12
                            filename: threat-package-2.0.0.tgz
                            sample_size: '23456'
                            source_url: https://registry.npmjs.org/threat-package/-/threat-package-2.0.0.tgz
                            identity:
                              purl: pkg:npm/threat-package@2.0.0
                              community: npm
                              package: threat-package
                              version: 2.0.0
                              homepage: https://threat-example.com
                              repository: https://github.com/example/threat-package
                              published: 2025-07-20T14:45:00+0000
                            sample_list:
                              - status: MALICIOUS
                                threat_name: Script-JS.Trojan.SupplyChain
                                threat_level: '4'
                                md5: b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5
                                sha1: 234567890abcdef1234567890abcdef123456789
                                sha256: bcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab
              schema:
                type: object
                properties:
                  rl:
                    type: object
                    properties:
                      supply_chain_ioc_feed:
                        type: object
                        properties:
                          last_timestamp:
                            type: string
                            description: Timestamp of the last entry in the feed
                          time_range:
                            type: object
                            properties:
                              to:
                                type: string
                                description: End time of the query range
                              from:
                                type: string
                                description: Start time of the query range
                          entries:
                            type: array
                            description: Array of supply chain IoC entries
                            items:
                              type: object
                              properties:
                                event_type:
                                  type: string
                                  description: Type of event
                                  enum:
                                    - NEW_MALICIOUS
                                    - FP
                                    - NEW_THREAT_NAME
                                md5:
                                  type: string
                                  description: MD5 hash of the package
                                sha1:
                                  type: string
                                  description: SHA1 hash of the package
                                sha256:
                                  type: string
                                  description: SHA256 hash of the package
                                sha512:
                                  type: string
                                  description: SHA512 hash of the package
                                filename:
                                  type: string
                                  description: Name of the package file
                                sample_size:
                                  type: string
                                  description: Size of the package in bytes
                                source_url:
                                  type: string
                                  description: URL where the package was downloaded from
                                identity:
                                  type: object
                                  description: Package identity information
                                  properties:
                                    purl:
                                      type: string
                                      description: Package URL identifier
                                    community:
                                      type: string
                                      description: Package community (e.g., npm, pypi)
                                    namespace:
                                      type: string
                                      description: Package namespace
                                    package:
                                      type: string
                                      description: Package name
                                    product:
                                      type: string
                                      description: Product name
                                    version:
                                      type: string
                                      description: Package version
                                    artifact:
                                      type: string
                                      description: Artifact identifier
                                    homepage:
                                      type: string
                                      description: Package homepage URL
                                    repository:
                                      type: string
                                      description: Package repository URL
                                    published:
                                      type: string
                                      description: Package publication timestamp
                                sample_list:
                                  type: array
                                  description: List of malicious samples found in the package
                                  items:
                                    type: object
                                    properties:
                                      status:
                                        type: string
                                        description: Sample status
                                        enum:
                                          - MALICIOUS
                                          - KNOWN
                                          - SUSPICIOUS
                                          - UNKNOWN
                                      threat_name:
                                        type: string
                                        description: Name of the detected threat
                                      threat_level:
                                        type: string
                                        description: Threat level (1-5)
                                        minimum: 1
                                        maximum: 5
                                      md5:
                                        type: string
                                        description: MD5 hash of the sample
                                      sha1:
                                        type: string
                                        description: SHA1 hash of the sample
                                      sha256:
                                        type: string
                                        description: SHA256 hash of the sample
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/Unavailable'
      x-codeSamples:
        - lang: bash
          source: ''
        - lang: Python
          source: ''
components:
  schemas:
    ImphashIndexBase:
      type: object
      properties:
        next_page_sha1:
          type: string
          example: 04869a625ea7d92fd8d1668aec77efd38a0c2506
        query_imphash:
          type: string
          example: 0931e97555ac33eb10aa9539fe890070
      required:
        - next_page_sha1
        - query_imphash
    NormalImphashIndex:
      allOf:
        - $ref: '#/components/schemas/ImphashIndexBase'
        - type: object
          properties:
            sha1_list:
              type: array
              items:
                type: string
                format: sha1
                pattern: '[0-9a-f]{40}'
              example:
                - 00018a78a1cae0ad6bf5bfb712147e99a4b15577
                - 0001cf4ef8aa7d50b014318743edac57fa31c569
                - 00045f60ebcca8d7c19b99519c545d99be5d3244
                - 00071c14a4b5c7bbe56b292c87bda7d7f9394373
                - 000a24c24e2c9c222d5aa662161646e4661f5929
                - 2cb199ed0920d479fa481dff0b3d33d53bed434e
          required:
            - sha1_list
    NormalImphashResponse:
      type: object
      properties:
        rl:
          type: object
          properties:
            imphash_index:
              $ref: '#/components/schemas/NormalImphashIndex'
          required:
            - imphash_index
    ImphashIndexBaseSample:
      type: object
      properties:
        next_page:
          type: string
          example: 04869a625ea7d92fd8d1668aec77efd38a0c2506
        query_hash:
          type: string
          example: 000a24c24e2c9c222d5aa662161646e4661f5929
      required:
        - next_page
        - query_hash
    NormalImphashIndexSample:
      allOf:
        - $ref: '#/components/schemas/ImphashIndexBaseSample'
        - type: object
          properties:
            list:
              type: array
              items:
                type: string
                format: sha1
                pattern: '[0-9a-f]{40}'
              example:
                - 00018a78a1cae0ad6bf5bfb712147e99a4b15577
                - 0001cf4ef8aa7d50b014318743edac57fa31c569
                - 00045f60ebcca8d7c19b99519c545d99be5d3244
                - 00071c14a4b5c7bbe56b292c87bda7d7f9394373
                - 000a24c24e2c9c222d5aa662161646e4661f5929
                - 2cb199ed0920d479fa481dff0b3d33d53bed434e
          required:
            - list
    NormalImphashResponseSample:
      type: object
      properties:
        rl:
          type: object
          properties:
            imphash_index:
              $ref: '#/components/schemas/NormalImphashIndexSample'
          required:
            - imphash_index
    BulkRequest:
      type: object
      required:
        - rl
      properties:
        rl:
          type: object
          required:
            - query
          properties:
            query:
              type: object
              required:
                - hash_type
                - hashes
              properties:
                hash_type:
                  type: string
                  enum:
                    - md5
                    - sha1
                    - sha256
                  example: sha1
                hashes:
                  type: array
                  items:
                    type: string
                  example:
                    - a7afddb68260a60f86c02a021efba7f216c2e7cf
                    - ca03064987d3c4465f91552ba8b6a883eecfd3e5
                    - b363713a938afcd3c74603827fab79e935b2b09b
    private_data_filtered:
      type: boolean
      description: Sample privacy from the perspective of the account requesting the report. If `private_data_filtered` is false, the sample either belongs to the requesting account or is publicly available, and the report includes all relevant information. If `true`, the sample was privately uploaded by a different account, and the report will exclude any private information.
    ListUsersResponse:
      type: object
      properties:
        rl:
          type: object
          properties:
            page:
              type: object
              properties:
                current_page:
                  type: integer
                  description: Current page number.
                next:
                  type: string
                  nullable: true
                  description: URL for next page or null if last page.
                previous:
                  type: string
                  nullable: true
                  description: URL for previous page or null if first page.
                total_pages:
                  type: integer
                  description: Total number of pages.
                total_records:
                  type: integer
                  description: Total number of records.
              required:
                - current_page
                - total_pages
                - total_records
            users:
              type: array
              items:
                type: object
                properties:
                  created_at:
                    type: string
                    description: Creation timestamp.
                  description:
                    type: string
                    description: User description.
                  email_addresses:
                    type: array
                    items:
                      type: string
                      format: email
                  enabled:
                    type: boolean
                    description: Whether the user is enabled.
                  updated_at:
                    type: string
                    nullable: true
                    description: Update timestamp or null if never updated.
                  username:
                    type: string
                    description: The username.
                required:
                  - created_at
                  - email_addresses
                  - enabled
                  - username
          required:
            - page
            - users
      required:
        - rl
    CreateUserRequest:
      type: object
      required:
        - username
        - email_addresses
        - enabled
      properties:
        username:
          type: string
          description: |
            The username of the user to create. Must be alphanumeric; "/" is allowed. This is the last segment of the username,  without the `/u/company/` prefix. The first and the last character must be alphanumeric. Can't contain "test", "demo", "temp" or "trial".
          minLength: 1
          pattern: ^[A-Za-z0-9](?:[A-Za-z0-9/]*[A-Za-z0-9])?$
        email_addresses:
          type: array
          description: The email addresses of the user to create.
          items:
            type: string
            format: email
          minItems: 1
          uniqueItems: true
        description:
          type: string
          description: The description of the user to create.
        enabled:
          type: boolean
          description: Whether the user is enabled.
    CreateUserResponse:
      type: object
      properties:
        rl:
          type: object
          properties:
            created_at:
              type: string
              description: Creation timestamp.
              example: 2025-10-15T05:21:38+0000
            description:
              type: string
              description: User description.
            email_addresses:
              type: array
              items:
                type: string
                format: email
            enabled:
              type: boolean
              description: Whether the user is enabled.
            password:
              type: string
              description: Returned only on creation.
            updated_at:
              type: string
              nullable: true
              description: Update timestamp or null if never updated.
            username:
              type: string
              description: The username.
          required:
            - created_at
            - email_addresses
            - enabled
            - password
            - username
      required:
        - rl
    UserResponse:
      type: object
      properties:
        rl:
          type: object
          properties:
            created_at:
              type: string
              description: Creation timestamp.
              example: 2025-10-15T05:21:38+0000
            description:
              type: string
              description: User description.
            email_addresses:
              type: array
              items:
                type: string
                format: email
            enabled:
              type: boolean
              description: Whether the user is enabled.
            updated_at:
              type: string
              nullable: true
              description: Update timestamp or null if never updated.
            username:
              type: string
              description: The username.
          required:
            - created_at
            - email_addresses
            - enabled
            - username
      required:
        - rl
    UpdateUserRequest:
      type: object
      properties:
        description:
          type: string
          description: The description of the user.
        email_addresses:
          type: array
          description: The email addresses of the user.
          items:
            type: string
            format: email
          minItems: 1
          uniqueItems: true
        enabled:
          type: boolean
          description: Whether the user is enabled.
    PasswordResetRequest:
      type: object
      properties:
        old_password_expiration_date:
          type: string
          format: date-time
          description: Optional expiration date for the old password. If not provided, defaults to 1 hour from request time.
          example: '2025-11-01T00:00:00Z'
    PasswordResetResponse:
      type: object
      properties:
        rl:
          type: object
          properties:
            password:
              type: string
              description: The new password.
          required:
            - password
      required:
        - rl
    CompanyInformationResponse:
      type: object
      properties:
        name:
          type: string
          description: The name of the company
          example: Company
        user_count:
          type: integer
          description: The number of users in the company
          example: 250
      required:
        - name
        - user_count
    uuid:
      type: string
      description: Unique, user-provided search identifier tied to each search query. The server returns this identifier in the response.
      example: 12-01
    communities:
      type: string
      enum:
        - npm
        - pypi
        - gem
        - nuget
        - vsx
        - psgallery
      description: Open source community identifier of the software repository that hosts the requested software package. Must match one of the [software repositories](https://docs.secure.software/community/#supported-communities) supported by Spectra Assure Community.
      example: npm
    identity:
      type: object
      required:
        - purl
        - community
        - namespace
        - package
        - product
        - version
        - artifact
        - license
        - published
        - deprecated
        - removed
        - category
        - homepage
        - repository
        - description
      properties:
        purl:
          type: string
          description: Fully qualified software package URL (including the artifact reference).
          example: pkg:npm/mock_react@19.0.0
        community:
          $ref: '#/components/schemas/communities'
        namespace:
          type: string
          description: Namespace of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
          example: ''
        package:
          type: string
          description: Name of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
          example: mock_react
        product:
          type: string
          description: Product name as declared by the publisher.
          example: Mock React
        version:
          type: string
          nullable: true
          description: Version of the software package (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
          example: 19.0.0
        artifact:
          type: string
          nullable: true
          description: Artifact file name (according to the purl schema pkg:community/namespace/package@version?artifact=filename.ext).
          example: ''
        license:
          type: string
          description: 'Package license as the SPDX license expression. The format is ReversingLabs-specific: LicenseFamily (SPDX-expression).'
          example: MIT
        published:
          type: string
          description: Package version publication date as ISO-8601 string.
          example: 2024-12-05T18:10:21+0000
        deprecated:
          type: boolean
          nullable: true
          description: Indicates if the version has been deprecated. Can be null if information is not available.
          example: false
        removed:
          type: boolean
          description: Indicates if the version has been removed.
          example: false
        category:
          type: string
          nullable: true
          description: Indicates the software category for the package version. Can be null if information is not available.
          example: ''
        homepage:
          type: string
          description: Package homepage or related website.
          example: www.example.com
        repository:
          type: string
          description: Source code related to the package.
          example: https://github.com/facebook/react
        description:
          type: string
          description: Package description as declared by the publisher.
          example: Mock React package for testing purposes.
        keywords:
          type: array
          description: Keywords associated with the software package.
    impl_quality:
      type: object
      required:
        - status
        - priority
        - assessment
      properties:
        status:
          type: string
          enum:
            - fail
            - warning
            - pass
          description: Overall package risk assessment evaluation result/status.
        priority:
          type: integer
          description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest). Optional.
          nullable: true
        assessment:
          type: string
          description: Overall package deployment risk.
        metrics:
          type: object
          description: Software quality metrics.
          required:
            - high
            - medium
            - low
          properties:
            high:
              type: integer
              description: Total number of policy violations with high severity on components.
            medium:
              type: integer
              description: Total number of policy violations with medium severity on components.
            low:
              type: integer
              description: Total number of policy violations with low severity on components.
    impl_artifacts:
      type: array
      items:
        type: object
        description: Artifacts related to the package version.
        required:
          - type
          - ref
        properties:
          type:
            type: string
            enum:
              - linked-package
              - rl-sbom-cyclonedx
              - rl-sbom-spdx
              - rl-safe
            description: Package artifact type. Linked packages are found in the package repository. RL packages are Spectra Assure generated artifacts. They might not be available for all packages or package versions.
            example: linked-package
          ref:
            type: string
            description: Package artifact reference. Linked packages use file names as references. RL packages use SHA-256 hashes as references.
            example: mock-1.22.4-.tar.gz'
    impl_assessment:
      type: object
      required:
        - final
        - enabled
        - status
        - priority
        - label
        - violations
        - count
      properties:
        final:
          type: boolean
          description: Risk is considered deciding when the final value is set to true.
        enabled:
          type: boolean
          description: Indicates that the risk assessment was performed during analysis. Spectra Assure license determines which risk assessments are performed.
        status:
          type: string
          enum:
            - fail
            - warning
            - pass
          description: Risk assessment evaluation result/status.
        priority:
          type: integer
          description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest). Optional.
          nullable: true
        label:
          type: string
          description: Risk assessment label to be displayed to the user.
        violations:
          type: array
          description: Policy violations that have caused the reported risk.
          items:
            type: string
        count:
          type: integer
          description: Number of risk associated with the risk label.
    assessments:
      type: object
      required:
        - licenses
        - malware
        - hardening
        - secrets
        - tampering
        - vulnerabilities
      properties:
        licenses:
          $ref: '#/components/schemas/impl_assessment'
        malware:
          $ref: '#/components/schemas/impl_assessment'
        hardening:
          $ref: '#/components/schemas/impl_assessment'
        secrets:
          $ref: '#/components/schemas/impl_assessment'
        tampering:
          $ref: '#/components/schemas/impl_assessment'
        vulnerabilities:
          $ref: '#/components/schemas/impl_assessment'
        repository:
          $ref: '#/components/schemas/impl_assessment'
    incidents:
      type: object
      additionalProperties:
        type: object
        required:
          - type
          - reporters
        properties:
          type:
            type: string
            enum:
              - malware
              - removal
            description: Describes the type of the incident.
          reporters:
            type: array
            items:
              type: object
              required:
                - type
                - name
                - date
                - link
              properties:
                type:
                  type: string
                  enum:
                    - rl-analyst
                    - rl-scanner
                    - community
                  description: Incident reporter. Differentiates between analysts, automated reporting, and community contributions.
                name:
                  type: string
                  description: Incident reporter name. Name is displayed to the user within the UI.
                date:
                  type: string
                  description: Incident date as ISO-8601 string.
                link:
                  type: string
                  description: Link to a resource that contains more information on the incident. Value is optional.
    impl_versions:
      type: array
      items:
        type: object
        description: List of package versions and their most important details.
        required:
          - version
          - published
          - incidents
        properties:
          version:
            type: string
            description: Package version.
            example: 19.0.0
          published:
            type: string
            description: Package version publication date as ISO-8601 string.
            example: 2024-12-05T18:10:21+0000
          quality:
            $ref: '#/components/schemas/impl_quality'
          artifacts:
            $ref: '#/components/schemas/impl_artifacts'
          assessments:
            $ref: '#/components/schemas/assessments'
          incidents:
            $ref: '#/components/schemas/incidents'
    impl_incidents:
      type: object
      description: Statistics for incidents reported for any package version.
      required:
        - malware
        - recent_malware
        - removal
        - recent_removal
      properties:
        malware:
          type: integer
          description: Total number of malware incidents reported for the package.
          example: 0
        recent_malware:
          type: object
          description: Describes malware incidents.
          required:
            - latest_version
            - latest_timestamp
            - recent_count
          properties:
            latest_version:
              type: string
              description: The latest malware package version.
            latest_timestamp:
              type: string
              description: The time when the latest malware version was published as ISO-8601 string.
            recent_count:
              type: integer
              description: The number of malware incidents in the last two years.
        removal:
          type: integer
          description: Total number of removal incidents reported for the package.
          example: 1
        recent_removal:
          type: object
          description: Describes removal incidents.
          required:
            - latest_version
            - latest_timestamp
            - recent_count
          properties:
            latest_version:
              type: string
              description: The latest removed package version.
              example: 1.2.0rc1
            latest_timestamp:
              type: string
              description: The time when the latest package removal occurred as ISO-8601 string.
              example: 2020-05-14T11:25:54+0000
            recent_count:
              type: integer
              description: The number of removal incidents in the last two years.
              example: 0
    package:
      type: object
      description: Software package metadata.
      required:
        - owner_verified
        - is_quarantined
        - first_published
        - total_versions
        - total_installs
        - total_downloads
        - latest_version
        - direct_imports
        - all_malicious
        - was_archived
        - was_removed
        - key_project
        - popularity
        - identity
        - versions
        - incidents
      properties:
        owner_verified:
          type: boolean
          description: Indicates that package ownership was verified by the package repository.
          example: false
        is_quarantined:
          type: boolean
          description: Indicates that the package may be quarantined in the package repository.
          nullable: true
        first_published:
          type: string
          description: Initial package publication date as ISO-8601 string.
          example: 2022-04-26T18:40:14+0000
        total_versions:
          type: integer
          description: Total number of currently published package/extension versions.
          example: 7
        total_installs:
          type: integer
          description: Total number of package/extension installations as tracked by the package repository.
          nullable: true
        total_downloads:
          type: integer
          description: Total number of package/extension downloads as tracked by the package repository.
          nullable: true
          example: 6231
        latest_version:
          type: string
          description: Latest published package version.
          example: 7.0.0
        direct_imports:
          type: integer
          description: Total number of other packages in the repository that directly import this one.
          nullable: true
          example: 312
        all_malicious:
          type: boolean
          description: Indicates that currently all package versions are reported as malware.
          example: false
        was_archived:
          type: boolean
          description: Indicates that the package may be archived in the package repository.
          nullable: true
        was_removed:
          type: boolean
          description: Indicates that the package was completely removed from the package repository.
          example: false
        key_project:
          type: boolean
          description: Indicates that the package is considered to be a key project in the community.
          example: false
        popularity:
          type: integer
          enum:
            - 10
            - 100
            - 1000
            - 10000
          description: Package ranking in the community based on the number of downloads.
          example: 1000
          nullable: true
        identity:
          $ref: '#/components/schemas/identity'
        versions:
          $ref: '#/components/schemas/impl_versions'
        incidents:
          $ref: '#/components/schemas/impl_incidents'
    oss-search:
      type: object
      required:
        - community
      properties:
        community:
          type: object
          description: Results of a Spectra Assure Community search.
          required:
            - packages
          properties:
            packages:
              type: array
              description: One or more software packages that match the search criteria from the request.
              items:
                required:
                  - uuid
                  - package
                properties:
                  uuid:
                    $ref: '#/components/schemas/uuid'
                  package:
                    $ref: '#/components/schemas/package'
            errors:
              type: array
              items:
                required:
                  - uuid
                  - error
                properties:
                  uuid:
                    $ref: '#/components/schemas/uuid'
                  error:
                    type: object
                    description: Package lookup error information.
                    required:
                      - code
                      - info
                    properties:
                      code:
                        type: integer
                        description: Package lookup HTTP error code.
                      info:
                        type: string
                        description: Package lookup HTTP error code description.
    oss-error:
      type: object
      required:
        - error
      properties:
        error:
          type: string
    hashes:
      type: array
      items:
        type: string
    file:
      type: object
      description: Details about the software package file.
      required:
        - name
        - size
        - source_url
        - downloaded
        - hashes
      properties:
        name:
          type: string
          description: Package artifact file name.
        size:
          type: integer
          description: Package artifact size in bytes.
        source_url:
          type: string
          description: Location of the package artifact in the remote repository.
        downloaded:
          type: boolean
          description: Indicates that the package has been successfully downloaded from the repository.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/hashes'
        identity:
          $ref: '#/components/schemas/identity'
    license:
      type: object
      description: Discovered license statistics.
      required:
        - undeclared
        - public_domain
        - permissive
        - weak_copyleft
        - copyleft
        - freeware
        - shareware
        - freemium
        - non_commercial
        - proprietary
      properties:
        undeclared:
          type: integer
          description: Number of software components and dependencies without a declared license.
        public_domain:
          type: integer
          description: Number of public domain software licenses.
        permissive:
          type: integer
          description: Number of permissive software licenses.
        weak_copyleft:
          type: integer
          description: Number of weak copyleft software licenses.
        copyleft:
          type: integer
          description: Number of copyleft software licenses.
        freeware:
          type: integer
          description: Number of freeware software licenses.
        shareware:
          type: integer
          description: Number of shareware software licenses.
        freemium:
          type: integer
          description: Number of freemium software licenses.
        non_commercial:
          type: integer
          description: Number of non-commercial software licenses.
        proprietary:
          type: integer
          description: Number of proprietary software licenses.
    vulnerabilities:
      type: object
      description: Discovered vulnerability statistics.
      properties:
        total:
          type: integer
          description: Total number of detected vulnerabilities.
        critical:
          type: integer
          description: Total number of critical severity vulnerabilities.
        high:
          type: integer
          description: Total number of high severity vulnerabilities.
        medium:
          type: integer
          description: Total number of medium severity vulnerabilities.
        low:
          type: integer
          description: Total number of low severity vulnerabilities.
        exploit:
          type: integer
          description: Number of vulnerabilities that have a known exploit.
        malware:
          type: integer
          description: Number of vulnerabilities that are exploited by malware.
        mandate:
          type: integer
          description: Number of vulnerabilities that are patching-mandated.
        fixable:
          type: integer
          description: Number of vulnerabilities that can be resolved by a package version update.
        named:
          type: integer
          description: Number of vulnerabilities that have distinguished marketing names.
    quality:
      type: object
      description: Overall software quality metrics.
      required:
        - status
        - priority
        - metrics
      properties:
        status:
          type: string
          enum:
            - fail
            - pass
          description: Overall software package policy evaluation result.
        priority:
          type: integer
          description: Highest priority issue within the software package. Range from P0 (highest) to P4 (lowest).
        metrics:
          type: object
          description: Software quality metrics.
          required:
            - total
            - pass
            - warning
            - fail
            - high
            - medium
            - low
          properties:
            total:
              type: integer
              description: Total number of policy violations on components.
            pass:
              type: integer
              description: Total number of policy violations that passed on components.
            warning:
              type: integer
              description: Total number of policy violations that caused a warning on components.
            fail:
              type: integer
              description: Total number of policy violations that caused a failure on components.
            high:
              type: integer
              description: Total number of policy violations with high severity on components.
            medium:
              type: integer
              description: Total number of policy violations with medium severity on components.
            low:
              type: integer
              description: Total number of policy violations with low severity on components.
    statistics:
      type: object
      properties:
        components:
          type: integer
          description: Number of software components discovered during Spectra Assure analysis.
        dependencies:
          type: integer
          description: Number of software dependencies discovered during Spectra Assure analysis.
        extracted:
          type: integer
          description: Number of artifacts extracted during Spectra Assure analysis.
        license:
          $ref: '#/components/schemas/license'
        vulnerabilities:
          $ref: '#/components/schemas/vulnerabilities'
        quality:
          $ref: '#/components/schemas/quality'
    detections:
      type: object
      description: File classification results.
      additionalProperties:
        type: object
        description: Detected threat type if any. 'No Threats Detected' used for Goodware and Unknown results.
        additionalProperties:
          type: integer
          description: Number of files that were detected as threats.
      example:
        Goodware:
          No Threats Detected: 19
        Malicious:
          Downloader: 1
    violations:
      type: object
      additionalProperties:
        type: object
        required:
          - rule_id
          - status
          - priority
          - severity
          - category
          - description
          - statistics
        properties:
          rule_id:
            type: string
            description: 'Unique policy identifier. A four digit number prefixed by a type identifier: SQ (software quality) or TH (threat hunting).'
          status:
            type: string
            enum:
              - fail
              - warning
              - pass
            description: Policy evaluation result/status.
          priority:
            type: integer
            enum:
              - 0
              - 1
              - 2
              - 3
              - 4
            description: Recommended policy violation fix priority. Range from P0 (highest) to P4 (lowest).
          severity:
            type: string
            enum:
              - high
              - medium
              - low
            description: Severity/impact of the matching policy.
          category:
            type: string
            description: Category of the matching policy.
          description:
            type: string
            description: Display label for the matching policy.
          statistics:
            type: object
            required:
              - applicable
              - enforcements
              - exclusions
              - violations
            properties:
              applicable:
                type: integer
                description: Number of files that the policy can be applied to.
              enforcements:
                type: integer
                description: Number of files that have failed due to the policy match.
              exclusions:
                type: integer
                description: Number of files that have an excluded policy match.
              violations:
                type: integer
                description: Number of files that have the policy match.
    indicators:
      type: object
      additionalProperties:
        type: object
        required:
          - rule_id
          - priority
          - category
          - description
          - exclusions
          - occurrences
          - violations
        properties:
          rule_id:
            type: string
            description: 'Unique behavior identifier. A four digit number prefixed by a type identifier: BH (behavior).'
          priority:
            type: integer
            description: Helps order behaviors for display. More impactful behaviors have a higher priority value.
          category:
            type: string
            description: Category that best describes the behavior.
          description:
            type: string
            description: Human-readable behavior description.
          exclusions:
            type: integer
            description: Number of files that have an excluded behavior match.
          occurrences:
            type: integer
            description: Number of files that have exhibit this behavior.
          violations:
            type: integer
            description: Number of files that have failed due to the behavior presence.
    classifications:
      type: array
      items:
        type: object
        required:
          - status
          - result
        properties:
          status:
            type: string
            enum:
              - Malicious
              - Suspicious
            description: File classification.
          result:
            type: string
            description: Fully qualified threat name. String validation can be done with the ReversingLabs Malware Naming Standard.
          hashes:
            type: array
            items:
              $ref: '#/components/schemas/hashes'
    vulnerabilities-2:
      type: object
      additionalProperties:
        type: object
        required:
          - name
          - cvss
          - updated
          - affects
          - audit
          - exploit
        properties:
          name:
            type: string
            description: Popular vulnerability name. Usually used by media or marketing departments.
          cvss:
            type: object
            required:
              - version
              - baseScore
            properties:
              version:
                type: integer
                description: CVSS schema version.
              baseScore:
                type: number
                format: float
                description: CVSS base score.
          updated:
            type: string
            description: Last vulnerability database update timestamp as ISO-8601 string.
          affects:
            type: array
            description: List of dependency PURLs affected by this vulnerability. For non-declared dependencies value 'non-manifest-component' is used.
          audit:
            type: object
            required:
              - author
              - timestamp
              - reason
            properties:
              author:
                type: string
                description: When vulnerabilities are triaged the audit record is populated to track who triaged the vulnerability.
              timestamp:
                type: string
                description: When vulnerabilities are triaged the audit record is populated to track when vulnerability was triaged. Timestamp is a ISO-8601 string.
              reason:
                type: string
                description: When vulnerabilities are triaged the audit record is populated to track the reason why the triage was performed. User-provided reason.
          exploit:
            type: array
            description: List of tags that describe the vulnerability.
            items:
              type: string
              enum:
                - UNKNOWN
                - EXISTS
                - MALWARE
                - MANDATE
                - FIXABLE
                - TRIAGED
    dependencies:
      type: object
      additionalProperties:
        type: object
        required:
          - type
          - purl
          - community
          - framework
          - product
          - version
          - license
          - vulnerabilities
        properties:
          type:
            type: string
            enum:
              - package
              - extension
            description: Software dependency declared by the package repository.
          purl:
            type: string
            description: Fully qualified package identifier (including the artifact reference)
          community:
            type: string
            enum:
              - managed
              - python
              - java
              - ruby
              - nodejs
              - vscode
              - powershell
            description: OSS community in which the dependency is published.
          framework:
            type: string
            description: Defines the framework requirements needed to run the dependency. Currently only for .NET/managed community use.
          product:
            type: string
            description: Product name as declared by the publisher.
          version:
            type: string
            description: PURL - version from pkg:community/namespace/package@version
          license:
            type: string
            description: 'Package license as the SPDX license expression. The format is ReversingLabs-specific: LicenseFamily (SPDX-expression).'
          vulnerabilities:
            type: array
            description: List of CVEs that were detected to affect the dependency.
    oss-version:
      type: object
      required:
        - community
      properties:
        community:
          description: Spectra Assure Community analysis report for a package version.
          type: object
          required:
            - report
          properties:
            report:
              type: object
              required:
                - info
              properties:
                info:
                  type: object
                  required:
                    - file
                    - analysis
                  properties:
                    file:
                      $ref: '#/components/schemas/file'
                    analysis:
                      type: object
                      required:
                        - version
                        - timestamp
                      properties:
                        version:
                          type: string
                          description: Spectra Assure core analysis engine version.
                        timestamp:
                          type: string
                          description: Last package analysis time as ISO-8601 string.
                    statistics:
                      $ref: '#/components/schemas/statistics'
                    detections:
                      $ref: '#/components/schemas/detections'
                    disabled:
                      type: array
                      description: List of disabled policy checks.
                metadata:
                  type: object
                  properties:
                    assessments:
                      $ref: '#/components/schemas/assessments'
                    incidents:
                      $ref: '#/components/schemas/incidents'
                    violations:
                      $ref: '#/components/schemas/violations'
                    indicators:
                      $ref: '#/components/schemas/indicators'
                    classifications:
                      $ref: '#/components/schemas/classifications'
                    vulnerabilities:
                      $ref: '#/components/schemas/vulnerabilities-2'
                    dependencies:
                      $ref: '#/components/schemas/dependencies'
    contributors:
      type: array
      items:
        type: object
        description: List of package contributor roles and people related to the project.
        required:
          - role
          - name
          - user
          - email
        properties:
          role:
            type: string
            enum:
              - developer
              - maintainer
              - author
              - contributor
              - owner
            description: Project contributor role.
          name:
            type: string
            description: Display name of the account associated with the contributor in the package repository.
          user:
            type: string
            description: User name of the account associated with the contributor in the package repository.
          email:
            type: string
            description: E-mail account associated with the contributor in the package repository.
    oss-package:
      type: object
      required:
        - community
      properties:
        community:
          type: object
          description: Spectra Assure Community analysis report for a package.
          allOf:
            - $ref: '#/components/schemas/package'
            - type: object
              required:
                - contributors
              properties:
                contributors:
                  $ref: '#/components/schemas/contributors'
  parameters:
    HashType:
      name: hash_type
      in: path
      required: true
      schema:
        type: string
        enum:
          - md5
          - sha1
          - sha256
      description: 'Required parameter. Specifies which hash type will be used in the request. Supported values: **md5**, **sha1**, **sha256**.'
    HashValue:
      name: hash_value
      in: path
      required: true
      schema:
        type: string
      description: Required parameter. Hash of the file for which the user is requesting data from the service. The value must be a valid hash of the same type specified by the `hash_type` parameter.
    ResponseFormat:
      name: format
      in: query
      schema:
        type: string
        enum:
          - xml
          - json
        default: xml
        example:
          - json
      description: 'Optional parameter that allows choosing the response format. Supported values: **xml, json**. When the parameter is not included in the request, defaults to **xml**.'
    RequestFormat:
      name: post_format
      in: path
      schema:
        type: string
        enum:
          - xml
          - json
      required: true
      description: Required parameter that defines the POST payload format. Supported options are `xml` and `json`. By default, the response format matches the format defined by this parameter.
    ResponseBulk:
      name: format
      in: query
      schema:
        type: string
        enum:
          - xml
          - json
      description: 'Optional parameter that allows choosing the response format. Supported values: **json, xml**. When the parameter is not included in the request, the response is in the same format specified by the `post_format` parameter.'
    response_format_JSON_default:
      name: format
      in: query
      schema:
        type: string
        enum:
          - json
          - xml
        default: json
        example:
          - json
      description: 'Response format. '
    NextPage:
      required: true
      name: next_page_sha1
      in: path
      schema:
        type: string
      description: Optional path parameter used for pagination. To get the next page of results from the API, use the `next_page_sha1` value from the response in place of this parameter in a new request. When the parameter is not included in the request, only the first page of results is returned.
    Classification:
      name: classification
      in: query
      schema:
        type: string
        enum:
          - known
          - malicious
          - suspicious
          - unknown
        example:
          - malicious
      description: 'Optional parameter that allows filtering the results by their classification status. If this parameter is provided in the request, the response will include only those samples that match the requested status. Supported values are: known, malicious, suspicious, unknown (case-insensitive).'
    Page:
      required: true
      name: page
      in: path
      schema:
        type: string
      description: Optional path parameter used for pagination. To get the next page of results from the API, use the `next_page` value from the response in place of this parameter in a new request. When the parameter is not included in the request, only the first page of results is returned.
    TimeFormat:
      name: time_format
      in: path
      schema:
        type: string
        enum:
          - timestamp
          - utc
      description: 'Required parameter that specifies the time format for the ``time_value`` parameter. Supported values: **timestamp** (Unix epoch time as the number of seconds since 1970-01-01 00:00:00); **utc** (YYYY-MM-DDThh:mm:ss).'
      required: true
    PostHeader:
      name: Content-Type
      in: header
      required: true
      schema:
        type: string
        enum:
          - application/octet-stream
      description: Required parameter that defines the POST payload format.
    CertificateThumb:
      name: thumbprint
      in: path
      required: true
      schema:
        type: string
      description: 'Required parameter that specifies the thumbprint of the certificate for which the user is requesting data from the service. The thumbprint value should be provided as a valid hash. Supported hash types are: **MD5, SHA1, SHA256**.'
    TimeValue:
      name: time_value
      in: path
      schema:
        type: string
        example: '2020-04-20T00:00:00'
      description: Accepts values in the format set by `time_format`
      required: true
    ResponseTSV:
      name: format
      in: query
      schema:
        type: string
        enum:
          - xml
          - json
          - tsv
        default: xml
        example:
          - tsv
      description: 'Optional parameter that allows choosing the response format. Supported values: **xml, json, tsv**. When the parameter is not included in the request, defaults to **xml**.'
    SampleAvailable:
      in: query
      required: false
      schema:
        type: boolean
        default: false
        enum:
          - true
          - false
        example: true
      name: sample_available
      description: If `true`, only samples available for download will be returned. If `false`, all samples will be returned.
    Limit:
      name: limit
      in: query
      required: false
      schema:
        type: number
        default: 1000
        example: 1000
        minimum: 0
        maximum: 1000
      description: The number of records to return in the response.
    ActiveCVE:
      name: active_cve
      in: query
      required: false
      schema:
        type: boolean
        default: true
        enum:
          - true
          - false
        example: true
      description: When true (default), returns only exploits with active CVE identifiers. When false, returns only exploit candidates.
    Categories:
      name: category
      in: path
      required: true
      schema:
        type: string
        enum:
          - apt
          - financial
          - ransomware
          - retail
          - exploit
          - configuration
        example: apt
      description: |-
        - TCF-0401: Advanced Persistent Threats (APT)
        - TCF-0402: Financial Services Malware       
        - TCF-0403: Ransomware                       
        - TCF-0404: Retail Sector Malware            
        - TCF-0405: CVE Exploits                     
        - TCF-0406: Malware Configuration            
    query_offset:
      name: offset
      in: query
      description: This optional parameter is used for pagination to specify the starting index when enumerating package versions in the response.
      required: false
      schema:
        type: integer
        default: 0
    query_limit:
      name: limit
      in: query
      description: Specify the maximum number of package versions to include in the response.
      required: false
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 5
    is_compact:
      name: compact
      in: query
      description: When this parameter is specified in the request, all optional response fields are automatically removed from the response to reduce its size. Intended for OEM and product integrations.
      required: false
      schema:
        type: boolean
        default: false
    purl_repository:
      name: repository
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/communities'
    purl_namespace:
      name: namespace
      in: path
      description: Namespace of the requested software package (according to the purl schema `pkg:repository/namespace/package@version`).
      required: false
      example: '@ampproject'
      schema:
        type: string
    purl_package:
      name: package
      in: path
      description: Name of the requested software package (according to the purl schema `pkg:repository/namespace/package@version`).
      required: true
      example: remapping
      schema:
        type: string
    purl_version:
      name: version
      in: path
      description: Version of the requested software package (according to the purl schema `pkg:repository/namespace/package@version`).
      required: false
      example: 2.3.0
      schema:
        type: string
    purl_artifact:
      name: artifact
      in: query
      description: Qualifier that specifies the artifact file of the requested software package (according to the purl schema `pkg:repository/namespace/package@version?artifact=filename.ext`). Note that some software repositories (communities) do not support searching for artifacts.
      required: false
      example: mock_numpy-2.2.0-.tar.gz
      schema:
        type: string
    purl_artifact_tag:
      name: artifact_tag
      in: query
      description: Qualifier that specifies the artifact file of the requested software package by a repository-specific tag (according to the purl schema `pkg:repository/namespace/package@version?artifact_tag=example_tag`). Note that some software repositories (communities) do not support searching for artifacts.
      required: false
      example: cp310-cp310-win_amd64
      schema:
        type: string
    match_pattern:
      name: match_pattern
      in: query
      description: Specifies the community-specific version glob pattern. Used for dependency resolution. Should not be used together with `version` or `match_expression`.
      required: false
      example: 1.3.*
      schema:
        type: string
    match_expression:
      name: match_expression
      in: query
      description: Specifies the community-specific version expression. Used for dependency resolution. Should not be used together with `version` or `match_pattern`.
      required: false
      example: <= 18.3.0
      schema:
        type: string
  responses:
    BadRequest:
      description: The request could not be understood by the server due to malformed syntax. A possible reason might be that the request contains Unicode characters that cannot be processed, or the specified time value is out of scope.
    Unauthorized:
      description: The request requires user authentication. All requests to ReversingLabs Spectra Intelligence services require the HTTP Authorization header with basic authentication. If the authorization header is not provided in the request, the services will respond with status 401.
    Forbidden:
      description: The server understood the request, but is refusing to fulfill it.
    NotFound:
      description: The server has not found anything matching the Request URI.
    TooManyRequests:
      description: The daily/monthly quota has been reached, or the API rate limit exceeded (in this case, the service will return an additional "Rate limit exceeded" error message).
    ServerError:
      description: The server encountered an unexpected condition which prevented it from fulfilling the request.
    Unavailable:
      description: The server is currently unable to handle the request due to a temporary overloading or maintenance of the server.
    RequestTooLarge:
      description: The request contained more than the maximum allowed amount of hashes (100).
    NotAcceptable:
      description: The sample type is not supported, or it exceeds the file size limit.
    Conflict:
      description: Can't complete the request.
    oss-search:
      description: OK
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/oss-search'
    bad-request:
      description: Bad request
      content:
        text/plain:
          schema:
            $ref: '#/components/schemas/oss-error'
          examples:
            MalformedRequest:
              value: Invalid structure of the request body
            UnsupportedParameter:
              value: Invalid argument, the {purl_type} repository doesn't support artifact argument in the request.
    unauthorized:
      description: Not authorized
      content:
        text/plain:
          schema:
            $ref: '#/components/schemas/oss-error'
          examples:
            NoToken:
              value: Authentication credentials were not provided
            WrongToken:
              value: Invalid token
    low-capacity:
      description: Insufficient remaining capacity
      content:
        text/plain:
          schema:
            $ref: '#/components/schemas/oss-error'
          example: Insufficient remaining capacity
    forbidden:
      description: Forbidden
      content:
        text/plain:
          schema:
            $ref: '#/components/schemas/oss-error'
          example: Forbidden
    content-too-large:
      description: Content too large
      content:
        text/plain:
          schema:
            $ref: '#/components/schemas/oss-error'
          example: Too many packages requested
    too-many-requests:
      description: Too many requests
      content:
        text/plain:
          schema:
            $ref: '#/components/schemas/oss-error'
          example: Too many requests
    server-error:
      description: Server error
      content:
        text/plain:
          schema:
            $ref: '#/components/schemas/oss-error'
          example: Internal server error
    oss-version:
      description: Spectra Assure Community analysis report for a version
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/oss-version'
    not-found:
      description: Not found
      content:
        text/plain:
          schema:
            $ref: '#/components/schemas/oss-error'
          example: Not found
    oss-package:
      description: Spectra Assure Community analysis report for a package
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/oss-package'
  requestBodies:
    BulkRequest:
      description: |-
        `hashes` is an array of valid hashes of the same type as specified in the `hash_type` parameter.
         
        Up to 100 hashes can be submitted in one request.
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/BulkRequest'
          examples:
            Example with one wrong hash:
              value:
                rl:
                  query:
                    hash_type: sha1
                    hashes:
                      - a7afddb68260a60f86c02a021efba7f216c2e7cf
                      - ca03064987d3c4465f91552ba8b6a883eecfd3e5
                      - b363713a938afcd3c74603827fab79e935b2b09b
                      - example_of_a_wrong_hash
    json_search:
      required: true
      content:
        application/json:
          schema:
            type: array
            items:
              oneOf:
                - type: object
                  title: SearchByPurl
                  required:
                    - uuid
                    - purl
                  properties:
                    uuid:
                      $ref: '#/components/schemas/uuid'
                    purl:
                      type: string
                      description: Fully qualified package URL (purl) of the software package to search for, in the format `pkg:community/namespace/package@version`. If the `version` part of the purl is omitted, the response contains information about the latest published version. The purl is case-insensitive. For more information on the correct purl syntax, consult the [official purl specification](https://github.com/package-url/purl-spec/blob/main/purl-specification.md#rules-for-each-purl-component).
                      example: pkg:pypi/numpy@1.2.3
                - type: object
                  title: SearchBySha1
                  required:
                    - uuid
                    - sha1
                  properties:
                    uuid:
                      $ref: '#/components/schemas/uuid'
                    sha1:
                      type: string
                      description: Search for a package with this hash, or packages that contain this hash. Hashes of embedded files are tracked only if they are malware artifacts.
                      example: d63932d669fe6da664b4183d8e1d5a33a9492b9f
                - type: object
                  title: SearchBySha256
                  required:
                    - uuid
                    - sha256
                  properties:
                    uuid:
                      $ref: '#/components/schemas/uuid'
                    sha256:
                      type: string
                      description: Search for a package with this hash, or packages that contain this hash. Hashes of embedded files are tracked only if they are malware artifacts.
                      example: 94957715a483aa3b9db60c8f22d5498227d8025c407f982eef81e34f37574ffd
                - type: object
                  title: MatchPurlByPattern
                  required:
                    - uuid
                    - purl
                    - match_pattern
                  properties:
                    uuid:
                      $ref: '#/components/schemas/uuid'
                    purl:
                      type: string
                      description: 'Partial package URL (purl) of the software package to search for. Must satisfy the following purl schema: `pkg:community/namespace/package?artifact=filename.ext`. For more information on the correct purl syntax, consult the [official purl specification](https://github.com/package-url/purl-spec/blob/main/purl-specification.md#rules-for-each-purl-component).'
                      example: pkg:pypi/mock-numpy
                    match_pattern:
                      type: string
                      description: Search for all versions that match the community-agnostic glob pattern.
                      example: 1.*.*
                - type: object
                  title: MatchPurlByExpression
                  required:
                    - uuid
                    - purl
                    - match_expression
                  properties:
                    uuid:
                      $ref: '#/components/schemas/uuid'
                    purl:
                      type: string
                      description: 'Partial package URL (purl) of the software package to search for. Must satisfy the following purl schema: `pkg:community/namespace/package?artifact=filename.ext`. For more information on the correct purl syntax, consult the [official purl specification](https://github.com/package-url/purl-spec/blob/main/purl-specification.md#rules-for-each-purl-component).'
                      example: pkg:pypi/mock-numpy
                    match_expression:
                      type: string
                      description: Search for all versions that match the community-specific expression.
                      example: '> 1.3.4'
                - type: object
                  title: MatchArtifacts
                  required:
                    - uuid
                    - community
                    - package
                  properties:
                    uuid:
                      $ref: '#/components/schemas/uuid'
                    community:
                      $ref: '#/components/schemas/communities'
                    namespace:
                      type: string
                      description: The namespace part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact=filename.ext`).
                    package:
                      type: string
                      description: The package part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact=filename.ext`).
                    version:
                      type: string
                      description: The version part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact=filename.ext`).
                    artifact:
                      type: string
                      description: The artifact part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact=filename.ext`). Note that some software repositories (communities) do not support searching for artifacts.
                    artifact_tag:
                      type: string
                      description: The artifact_tag part of the purl to search for (according to the schema `pkg:community/namespace/package@version?artifact_tag=example_tag`). Note that some software repositories (communities) do not support searching for artifacts.
                    match_expression:
                      type: string
                      description: Search for all versions that match the community-specific expression. Should not be used together with `version`.
                      example: '> 1.3.4'
                    match_pattern:
                      type: string
                      description: Search for all versions that match the community-agnostic glob pattern. Should not be used together with `version`.
                      example: 1.*.*
