24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T432,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 14f3e08339f9… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 14f3e08339f9…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/14f3e08339f997cd2826cd2a2072b704b96b9d30519de112f9fe1f5e8fed70a3","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","14f3e08339f997cd2826cd2a2072b704b96b9d30519de112f9fe1f5e8fed70a3"],"about":{"@type":"SoftwareApplication","name":"https://indico.slac.stanford.edu/event/2891/","applicationCategory":["url"],"identifier":"14f3e08339f997cd2826cd2a2072b704b96b9d30519de112f9fe1f5e8fed70a3","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":0,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5fa,"urlblockindex_1_.bin" has type "data" "FB0DD30266AF9B4A57FF10335BAF014F_84BE5D83C2A228D238A5759261A42F89" has type "data" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "liberationsans-bold-webfont__vacb1e937_1_.eot" has type "Embedded OpenType (EOT)" "07CEF2F654E3ED6050FFC9B6EB844250_DFECE1A4D0C745EF29E7B51A2DA008B8" has type "data" "module_events.cloning.bb850454.bundle_1_.js" has type "ASCII text with very long lines" "user_1_.js" has type "ASCII text with no line terminators" "~DF629ADEA7BDD3791A.TMP" has type "data" "common.97c499cc.bundle_1_.js" has type "UTF-8 Unicode text with very long lines" "jquery.7eb426fa_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators" "en-US.3" has type "data" "outdatedbrowser.1f20c4ac.bundle_1_.js" has type "UTF-8 Unicode text with very long lines" "~DFAF906C1B2C7503F3.TMP" has type "data" "jquery.16c4224d.bundle_1_.js" has type "ASCII text with very long lines" "social_1_.png" has type "PNG image data 67 x 43 8-bit/color RGBA non-interlaced" "favicon_2_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "module_attachments.efa7291e.bundle_1_.js" has type "ASCII text with very long lines" "Roboto-Light-webfont__v9de1a798_1_.eot" has type "Embedded OpenType (EOT)" "themes_lecture.f9876b3c_1_.css" has type "assembler source ASCII text with very long lines" "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced"26:Te42,Pattern match: "https://indico.slac.stanford.edu/event/2891/" Pattern match: "https://indico.slac.stanford.edu" Heuristic match: "indico.slac.stanford.edu" Pattern match: "http://ogp.me/ns#" Pattern match: "http://www.mathjax.org/help-v2/user/" Pattern match: "https://indico.slac.stanford.edu/export/event/2891.ics?detail=events,publicRequestURL:https://indico.slac.stanford.edu/export/event/2891.ics" Pattern match: "https://indico.slac.stanford.edu/login/?next=%2Fevent%2F2891%2F" Pattern match: "https://megalium.com/tv/48866/the-100/7/14" Pattern match: "https://slac.stanford.edu/" Pattern match: "https://github.com/faisalman/ua-parser-js" Pattern match: "http://creativecommons.org/licenses/publicdomain/YwIDAThZyt%!$XD," Pattern match: "https://icomoon.io/app/" Pattern match: "https://github.com/brianreavis/selectize.js/blob/master/examples/github.html" Pattern match: "http://momentjs.com/guides/#/warnings/define-locale/" Pattern match: "http://momentjs.com/guides/#/warnings/zone/,function(t,e){return" Pattern match: "http://jedwatson.github.io/classnames" Pattern match: "https://github.com/SlexAxton/Jed" Pattern match: "https://github.com/jonschlinkert/repeat-string" Pattern match: "https://indico.slac.stanford.edu,BasePath:,Categories:{info:{endpoint:categories.info,rules:[{args:[category_id],converters:{category_id:IntegerConverter},defaults:{},trace:[{data:|,is_dynamic:false},{data:/category/," Pattern match: "https://feross.org" Pattern match: "https://fb.me/react-polyfills" Heuristic match: ")||this.addTargetHandler(e)}},{key:hasHandlers,value:function(){return this.handlers.size>0}},{key:removeHandlers,value:function(t,e,n){if(this.pools.has(t)){var r=this.pools.get(t).removeHandlers(e,n);r.hasHandlers()?this.pools.set(t,r):this.pools.del" Pattern match: "http://git.io/vg5Ft" Pattern match: "http://,https://,p],h=d.length;function" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Pattern match: "http://jqueryui.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "e.size/1024/10.24" Pattern match: "https://zenorocha.github.io/clipboard.js" Pattern match: "https://sizzlejs.com/" Pattern match: "http://jquery.org/license" Pattern match: "http://www.jacklmoore.com/colorbox" Pattern match: "https://github.com/jquery-form/form" Pattern match: "http://www.runningcoder.org/jquerytypeahead/" Pattern match: "l.mod/2?o+=l.mod:o-r" Pattern match: "https://cdn.mathjax.org/mathjax/contrib};e.Ajax={loaded:{},loading:{},loadHooks:{},timeout:15e3,styleDelay:1,config:{root:,path:o},params:{},STATUS:{OK:1,ERROR:-1},fileURL:function(t){for" Pattern match: "http://www.w3.org/1998/Math/MathML" Pattern match: "https://github.com/Craga89/qTip2/issues/367" Pattern match: "http://docs.ckeditor.com/#!/guide/dev_errors-section-+n" Pattern match: "http://,r=t.url&&CKEDITOR.tools.trim(t.url.url)||;i[data-cke-saved-href]=0===r.indexOf(/)?r:o+r;break;caseanchor:var" Heuristic match: "wysiwyg==e.mode)if(t){CKEDITOR.env.gecko&&o(e),e.getSelection().selectRanges(t);var R=e.getSelection().getStartElement();R&&R.scrollIntoView(!0)}else c.$.scrollTo(r.x,r.y);else t&&(E.selectionStart=t[0],E.selectionEnd=t[1]),E.scrollLeft=r[0],E.scrollTop=" Pattern match: "https://github.com/mikemaccana/outdated-browser-rework" Pattern match: "http://kevin.vanzonneveld.net\n" Pattern match: "http://code.google.com/p/chromium/issues/detail?id=72568\n" Pattern match: "https://www.msn.com/spartan/ientpgbconfig?locale=en-us&market=us" Pattern match: "connect.facebook.net/en_US/all.js#xfbml=1,function(){FB.init({appId:t,status:!0,cookie:!1,xfbml:!0}),FB.Event.subscribe"27:T843,"iexplore.exe" wrote bytes "b0339c6e" to virtual address "0x74BA1038" (part of module "VERSION.DLL") "iexplore.exe" wrote bytes "a0359c6e" to virtual address "0x75EE202C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "c0bf9d6e" to virtual address "0x75EE1F68" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "a0359c6e" to virtual address "0x76DB131C" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "70cc9f6e" to virtual address "0x76DB1310" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "b0339c6e" to virtual address "0x75AA1164" (part of module "USP10.DLL") "iexplore.exe" wrote bytes "a0359c6e" to virtual address "0x7743B0CC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "b0339c6e" to virtual address "0x6DB0F6A0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "b0339c6e" to virtual address "0x74021250" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "60d29f6e" to virtual address "0x75EE1D7C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "60cd9f6e" to virtual address "0x76DB130C" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "b0339c6e" to virtual address "0x77871210" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "30309c6e" to virtual address "0x76DB1380" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "80329e0070329e0000329e0060329e0050329e0040329e0030329e00000000002cc9fe75c0219e000000000090179e0050239e0000189e00601f9e0020369e000000000040369e0000000000" to virtual address "0x009E8000" "iexplore.exe" wrote bytes "a0359c6e" to virtual address "0x7402139C" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "b0339c6e" to virtual address "0x009E70C0" "iexplore.exe" wrote bytes "c03a9c6e" to virtual address "0x75EE1FB0" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "30309c6e" to virtual address "0x6DB0FE90" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "b0339c6e" to virtual address "0x771E11BC" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "b0339c6e" to virtual address "0x76DB11B8" (part of module "SHLWAPI.DLL")28:T564,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD0klEQVR42u2XS2hTWRjHg7Nw4TADYqcdxFbFMqtZjjOzUgdFRWtbEjuPMgu3wygoCqXooKIoVGiNaZuWLtsunIdTmG4GN4VQZmBaLPRlKK0P0iZ9JJmYx03u4+/3nZs0zTX39jZx2Q/+5EHO+f++75zznRuHYzu2wxBTU1NYWlrC8vIygsGgTem/DwQCGB0dRX19PUoGmJ6ehqZpKCVkWQaPZwin04mSAdLptJiQQTRNhaqaSYGi5MUxNzcHv9+PyclJNDY2okwAc2OjeQ7gxYsFLC4uis8TExNobm5GyQB2ss5LFmM4+/n5efE+EonA5/PB5XJhSwCSJJkCmJnnAGZmZjA42E8axMDAAIaGhjA8PPy+AMzNeQOychEKhQTM2NiYgCgTQDE1zxnnlUEmkyk4SbOzs+UAbJ71RvMcgC6eR0MikSgVoBzztBADRKPRrQKkRAk3L7nRNG/MJ4nF80Sjka0BpFJGALkk83RaEr3EEuCni5dx9eq1kuT2dL1jngeQ7AHwRG9opVaokYUyQJIno+z5QBWXJsTBY63McwDckCwBlsn8ZQxYSgB3+v/BruMPUHXOjUPf9qD2O++6Pm3woJa+U8QdoWUBjGXPA/Bm5pMUiYStAVZUYCGi4jVBxGnQn6MLONDUhap6N6qd3ah2dZK6sOdMB2oa3JDVQgCjcc5cB1A2B1glgJcE8CoKBGJpQX2bKrH7dDtqzndjf1YVBHDI2VFQAStzPk22AV5R9lyBJA18OhHAgfNe1Ljy5vubvPhEADwsAiAZAFLrsgUQhm4ep9fxuVV89kMv9jk7ydgrzPc1erC34RFVoB21BLBxCcwy3wgQDm8CEOHLIwW8oUqcvfYbKurcONjULcpfVdeBytNttPYd2HXsHg42tBsqUNyYxf2E+0c4vGYN8D8B0AHAyFQIlXUPaQN61813fHUTv4/M4L/nQTi+/AWVJ+8XAJgZ60raA+A+QMnD8+QZPj7VLgC45B98fRPux/9mH800DPme46MjtwuWwGiuAyTXZQsgnr023X88w4cnHtDm68LOI3fR0vlUGEmsrOlfPr+hAsWy3yJAItvl/h4PYOc3bbQMblTRuq/EJGEUl1XqkCokRTc2AzCa2wbgyzdKbZj2IY7+3A/H56344kKvMJFJSQJIkSRSWlENS5BEMslKFFUmI2N1dcUagG/ttZRehWA4ju+v/wrH4Rv48dYTjPlDIDZQAQgGlL2+X3J3gd2wBOBQsj+MxWKIx+PiKcZKXG4e29vbU1Q9Pbr6+vrg8XjMAS5eulLyddzS2opy/wq+BTgoCRlpZOGDAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"14f3e08339f997cd2826cd2a2072b704b96b9d30519de112f9fe1f5e8fed70a3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1791237762455,"unified_at":"2026-10-05T22:02:42.455Z","metadata":{"hashes":{"sha256":"14f3e08339f997cd2826cd2a2072b704b96b9d30519de112f9fe1f5e8fed70a3","sha1":"2b05db901f3358566bc6aaf7940f01a4ba98334f","md5":"b00ede055de83e3ddc1915164d751b8d","sha512":"6a2ed6fc960773fec9625c461e6aacdc7bbbdebbd2b313ffc5c0e704fc22f885087a29710940843b24b98414042046555204828d706412893d30135d39f2e246","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://indico.slac.stanford.edu/event/2891/","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1600293598000,"last_seen":1626724252000,"last_multi_scan":1626724252000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":2},"sandbox_signatures":{"informative_count":12,"suspicious_count":3,"malicious_count":0,"total":15},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/73531bd7-5ac2-4351-8eb5-d819672877aa/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.pki.goog\"\n \"_ldap._tcp.dc._msdcs.scl3.dc\"\n \"indico.slac.stanford.edu\"\n \"isatap.scl3.dc\"\n \"wpad.scl3.dc\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"134.79.138.106:443\"\n \"172.217.9.36:443\"\n \"172.217.8.163:80\"\n \"23.36.85.183:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IsoScope_dc8_IESQMMUTEX_0_519\"\n \"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData\"\n \"Local\\InternetShortcutMutex\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"UpdatingNewTabPageData\"\n \"IsoScope_dc8_IESQMMUTEX_0_519\"\n \"IsoScope_dc8_IESQMMUTEX_0_331\"\n \"IsoScope_dc8_IESQMMUTEX_0_303\"\n \"IsoScope_dc8_ConnHashTable<3528>_HashTable_Mutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"Local\\ZonesCacheCounterMutex\"\n \"IsoScope_dc8_IE_EarlyTabStart_0xa7c_Mutex\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3528\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_dc8_IESQMMUTEX_0_303\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_dc8_IESQMMUTEX_0_331\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00064143-00003528) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://indico.slac.stanford.edu/event/2891/\" (UID: 00064143-00003528)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3528 CREDAT:275457 /prefetch:2\" (UID: 00064182-00000808)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://indico.slac.stanford.edu/event/2891/\" (UID: 00064143-00003528)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3528 CREDAT:275457 /prefetch:2\" (UID: 00064182-00000808)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 900)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"Network Related","name":"Contacts Random Domain Names","description":"\"_ldap._tcp.dc._msdcs.scl3.dc\" seems to be random\n \"wpad.scl3.dc\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f628ade34bb8f1b415742d4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"erica/Guatemala