26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T41f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 3e89907a3d0b… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 3e89907a3d0b…. Threat score 0/100. 0/1 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3e89907a3d0be1fa670a803e66ecee2276162d8faec2481fe54a6192113baad7","keywords":["malware analysis","sandbox report","threat intelligence","3e89907a3d0be1fa670a803e66ecee2276162d8faec2481fe54a6192113baad7"],"about":{"@type":"SoftwareApplication","name":"https://www.reddit.com/r/KSIvsSwarmzFightliv/comments/wyu21e/ksi_vs_swarmz_stream_on_reddit/","applicationCategory":["url"],"identifier":"3e89907a3d0be1fa670a803e66ecee2276162d8faec2481fe54a6192113baad7"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":0,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta56,"urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "~DFD6A30D7214CD4FED.TMP" has type "data"- Location: [%TEMP%\~DFD6A30D7214CD4FED.TMP]- [targetUID: 00000000-00002576] "~DFD8ED77E70DD1F3A8.TMP" has type "data"- Location: [%TEMP%\~DFD8ED77E70DD1F3A8.TMP]- [targetUID: 00000000-00002576] "Regular-e6bbcdd30d3bd4d6b170bcb6d3552cab-font_2_.woff" has type "ASCII text with no line terminators"- [targetUID: N/A] "Reddit.a4fedfc38ea71f9c57ea_1_.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "G7FQQG62.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\G7FQQG62.txt]- [targetUID: 00000000-00003068] "UsersCountIndicator.bd91bb4ddaf792552b85_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Light-Italic-112953068bc678d61f4553a1184561f0-font_1_.woff" has type "ASCII text with no line terminators"- [targetUID: N/A] "-core-styles-fonts-ibmplexsans-bold-736188bb57_1_.woff" has type "Web Open Font Format TrueType length 66184 version 2.1"- [targetUID: N/A] "runtime~Reddit.3b883c3d5d571006a7ec_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Governance~ModListing~Reddit~Subreddit.6a5953ba9ca39d9deca2_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "Medium-Italic-a25d440012460eb8883e539f93040fa7-font_1_.woff" has type "ASCII text with no line terminators"- [targetUID: N/A] "vendors~Chat~Governance~Reddit.e1e0852a48d91805a9f6_1_.js" has type "data"- [targetUID: N/A] "_9AC1F03F-25B7-11ED-B36A-080027CCEDAB_.dat" has type "Composite Document File V2 Document Cannot read short stream"- [targetUID: N/A] "Governance~Reddit~Subreddit~reddit-components-ClassicPost~reddit-components-CompactPost~reddit-compo~bd4baca2.7e41b9370d7e062d4907_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "6Y9H7KJJ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6Y9H7KJJ.txt]- [targetUID: 00000000-00002576] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00002576] "RecoveryStore._9AC1F03D-25B7-11ED-B36A-080027CCEDAB_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "redesignFont2020.f526ced67754443af2188dfb4c28e16b_1_.eot" has type "Embedded OpenType (EOT) redesignFont2020 family"- [targetUID: N/A] "Chat~Governance~Reddit.237555fc8995ce18fd46_1_.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A]28:T2327,"GET /r/KSIvsSwarmzFightliv/comments/wyu21e/ksi_vs_swarmz_stream_on_reddit/ HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.reddit.com DNT: 1 Connection: Keep-Alive"- [Source: SSL_151.101.1.140] "g 2024 05:24:30 GMT; HttpOnly; Secure Set-Cookie: csv=2; Max-Age=63072000; Domain=.reddit.com; Path=/; Secure; SameSite=None Set-Cookie: edgebucket=8gwoaf6MxTl55oYyVf; Domain=reddit.com; Max-Age=63071999; Path=/; secure Server: snooserv Report-To: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]} NEL: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.2, "failure_fraction": 0.2} transfer-encoding: chunked"- [Source: SSL_151.101.1.140] "ffa"- [Source: SSL_151.101.1.140] "ks0`dZqYlM0&f00}; `HJb[O>}w~U~To~G7 /4#n|?ys^/z|tPohu|7z+t'r77#=y{l=7]Y!\`g| ;V -v>|-Ls[6mSvy 8m^?olu9:C5;6{8(4b8//*pY+pYv;'M>yUv`?y>)I]Jzxba> *m.lmh]l ^w%;M;gS;7+]Wn+;]i@#tW7UwY4uGW~r>bU76-nr2`-n>iCm-*2tC![3>7Eu(ru/-A^;w #eRO)aLHv|@+!(d..]vQIRD|*6x{zM1o"- [Source: SSL_151.101.1.140] , "MP&c4D*Gw9wGHv4&| WQm4Ex3.$@D@yS-;j?_E8zGIh+Em8$heHAN>V?gb*42?HCO:^=h;pdA0K&}(+x7r@J6 ,N)cmpUlqloi>~Y.?$[/$zS)!hCKwNXXQ 0%dZ0niGhr vu"x/6b L30|c+7aX?{PuUY"jOda2>PnnQp<^{p81n }b\()1L$j!SSZ=GQ8yRn[zED lF!vL]h!&@H'K6m68g)F0+0_Cd. i[te6MUZl3Ex$1p\;qoF130BWWiGbp6@4gBz7dxgFI{H z"- [Source: SSL_151.101.1.140] , "u=v;T"a{SmG [47V1O\1 5,/!00j+IpjdpCp`oHYA '_uiu6*#h]>ywcA$qhdL0 b\vX\M%\xsPc WS_yQ[reUa^&K#5"G`y9~vW?,;%u}Ie!,S&R@9_dA890vT9+XU`}mHg2:?IR@O)yW|D)6%.? 0Z{T(H,i3u&.ISgRbHKObrPV)3te[(MY<36o~SXoqO}t{XXK|`\gdm8)8nc$K|!Evcf]{R@85O+ !#N1,LZm&nk[ t.L5vHT{d$LLKF< ngZvYe3P,]#5CB6w/#2O-?qu~oslz.kom_@&44G?C94aMC94aM-&XtBBaOY\dMt`jB]%8)ThO}e1}D`rd7]?Jt~7vD j(*!5)S2x2R7/ICd([wp6F4|$me,0,0,0,0&?2v!R1BDN4PpoQ*numxy_YAjyk7{E^%Zxl@"{-Lu#NLDX\oWy\_}WQY9Eop $"mYTK\/&+Irh@\P&]y!qIsA9)x8fy@{ KTFw4yES:>2;^(8.2j13EE*~ 9&2 O><=38gL no %=OI5!1th"La4|&jBu4?~Yvkjw>ut*>!ZP H{sDc&}R3t ^b@<-IOeQh{OZqnk;"S&h!1KxaI&$])`9,gl r6X~^~CM="- [Source: SSL_151.101.1.140] "&ih(Rn?j3h=TCMS7qJ?]!R e7(TDc\(TneT[Ygv~=," "," "oD$7w!/l#wElfwazfNofNofNofNCk;g$hvkF ^W^($r|P(8DlJL>vEyowO=\~*JZ7*U`TGyJn\f5?-!A?HU4`QcUGX|is[+C''H!H+M!~J`($%Hmg[}@v?btBM;!8i`qNl\e"5|I|R<4g _FUHg jgC>~kiqjNk56pi*j$:7DYQSgRbHKON\rPB (-e& 7O?p ab7qqztEz{+}S/N}~;Gq4}40#<<|mtyS@:NZ"^im&),Qnmj:c(1dv[fI0%g#>J2)`Z,E-dE^c^C2A#If:SMI2E$3bR+ky2M}WPGql\Y/6h=u4oa4)Y0Y$N1`gnT'4=NBZsQJKA1}e/<73]KA{&u*/$l6Aju n(e2 6M"xEvW?f()_rd4)ig6Zm&nkJH t.L5vHT{d$LLKF{~{?X{Frnd`W_9?Q[Z5A&Fd-%CRl`XH|-u]XI'("- [Source: SSL_151.101.1.140] , "E@VC|J]|V9DyQC9DyQC?WwR);RWDYdjzBa_yBjyVg-?Q((y*&G2^Wq}w;JdS{.]w(==yE,*ic93=DYpDXIE @5XCLy$$P&4O7D0~X %$h{3 HQ u\})d2;^(8[mS3fFT4Hs-?e3 O><=38gL no %=RXvV4vuZ|Fg& D\!:[S[W FB+gA. m|>kQHC-:e_=:tXfiH!2IR=" ir?K+|f`K2o&hH 23>~5c$+@KO5Is5Ak:hKH'D52'I._8}L[nWE=)9c#g:ItSIQ WHOL%yli'rAak@;qAAl1HTZ`+ [6Hh~;=RtHxZeZS&'0xnafm#+p!c Ej-GX+S>/|N"- [Source: SSL_151.101.1.140] , "%d7Ox*"R3l 'nFbZ@:^w=8 gl r6X` {%{57ItKb54TR94Q@$HpWC92BMM:E\dIkCI@C6&s2}i7S 2k(#4F@R D8v; U,T@,NL;,"&SZEol9(lRP,~DK]o&:*2p|*bt"BUL(=FCrbrPLQ nD`n_EY$EY$EY$EY$nc2umuH ZL."AV8zuhvxTZMnHkSp( ^I393939397Ir^E~>]"y5,>V|+)RAxr vuho-M4iorFCwz * WE 3xC/u/TG2aanB3SFo~ ~bOZ TU/=3t'M=X57{gq~g4~e2Mhr&}~ eSt xZf,\z,Br ~%lLR3BBeI x1{_$7,i.}a'A ^OmYBWpGN/cc'{Yt]tcpR-opRJrl`R,0dWTEHw_s7e%C:FKl#aXdg%dF7n/Pz$.lf$ %#t^VjJi36y`@fnd' D#3Yw(4yi$/&H%`!M*#lqz6N8=gmC6d]D(~T{d PJ1.s $G:y'HB:`:7zfvo;Et,*[Jc15W*QHiI{7<{=Aa"a`J-!$ ""{3)B+"D!EQND:LTxGvP'Px)j`bZ46Kc46Kc46Kc46Kc4V-h/64pbbvaj]Ms-+U,\dxosfZ"o&O!64-aw 9^TH!$fv}l\bB $C YoD53>k=~kT#>mWK0)>)HaI^7pX& /tjX%"- [Source: SSL_151.101.1.140] , "1006"- [Source: SSL_151.101.1.140] , "B)Kv?P(%XGT65@o@DiCI====}hmz^W*v[_N!32*Y@p}C')kWx/m ;Q#b-A'9RbYu2R=5q\," Vo+rl/n0X/g,y=C9Es.Kb84.2_J_=dr25B,Wl@*>PdcD-7c62Q#uEy[(hsA3n@T`UgO<"Y#W~]SnT.6Lcl#|AvOx,CPj3[&d?)Up}5IS;M%#Ni;du'gUjtVY5:F?oPv7 N)%2Q#=RO5FjhQqU`VYU0 fU* .' 9Wj vu1bOz)/17Hr o*A%j>hG"k}Xb`J$x)C ='b %WwQ~Z1hIW+77 #ClK}T|D(XoN`q~9k@X]P1`3RM)9x`~ x_OJ)y5`Cs=(yS+@qkL>M v|53JX&aiO4_+9oCZDv8@L*ag1KR3JM}`"/mi0 &Wo@tG.EUV|BL[d220g?_zH$>WZDW6*dJi!QZdIt*eU |~@_L{0T-Zh|7*7729g$B'(Hc4~u~4 Mu9&B\ M}\"d_1<8=c_v#s"- [Source: SSL_151.101.1.140] , "Z|@;2a)8^c)vd8 `3#h@QNC L5hN=;7 ^6Z|&?h[5\A=4gIL~eZk5FTSL[<%YqpheU@UFv:ohR.?3X54cU-3O)'s7cnqsy?FL8kL?3j+qpxD;7)lbD0x*aj91x]Z(-!F"- sl7{;i]'!H(VbO:CImY']nVKojt=1FKi :?Ea=c`x{-7HEL-eK?A:S50o )f7Fi5(N MKL(ITi(/)4VAx}^d{i]{i4d.@[do[ t O1K97QG#yRo+FJA9MN/3D\M e/t2=c`7s gfcE %zahFaC-(dQc/n`;g&<0*'&;R[pG+9[|y ((h*Nf2idQ,wM}POX$a"S$lP$.EPrL5 T~"XaTuUh67E}Wt[dS@yv8Y4f @Ic3C1^OXW|c(KCHs1:<"nM">mdSU"- [Source: SSL_151.101.1.140] , "2ffa"- [Source: SSL_151.101.1.140] , "h6bX2*(N6%2tE-DF~(E|(gEQFdGFQRvBd<[JO,|J[dgHaM1jr#ZfQZQ=l+i fbeF5\{Q[uu[ P9VN {7.gui%UuKQW4x<[X`T8IQ+RIX`8R&MIV%Sa8T./h1-gyqnuUhn$g~\ tHH-*wh-C3#OoC'UNR)0s}3Y)Y7t&nSB^80`AV'(UXNy@gW,// us_3D~}mK8J=p=8xN^9HM;V<)"k_E48HMk3&V, 1"kHdPoyj6beqGZ Hh/7e$g[eE8bnhD~(k-66_e"S[NE.O|@GiFFk!_`]]rg+QtuyZa\J>Lef[[.SQ{Xz)I0KwU&WOe'mCDCeoVBdz~}D7'>J1d{P 7h"- [Source: SSL_151.101.1.140] , "6y{BV}@z(?r5SK*j%}ph-V@Cr h;uY pA\70$PMm i * biV?qt-^nsm_#C,WUJR)+osMlqcSWl.&Bc+lPP_ENOZg`]'/CW>c-gpB74{D?PUI3v0jgBj(\]'xrOewzU82fH"q(!-X0!\C,!'XqNve14%{O=_Ov"Hs>66A2X24)V-g[ZL'< 2}Td}@?BR;oI-[>OS;>OS;~>'_ | *wJ<9OcMmz=.Pe>P8tEP"ya0!m+ihg53x =L8-nl\H Ak3'y2_8$J63@ZD;G72b["d|O{&kjlsCDQ*9Q/!fSQ@zf`IC(yrh=BRt^j n#'y8cGqwbj<,7@]]s!>K9a|{X|v%n{JOp6rLYLaGNu:Y:TgSuNUSp}L*F$IiUxx"r@qyqcVUj8X\wr9d]f^ '5oV0gAq(w'a;>Q+ MnTwW>]% QMar4SM\S=?TmYl.~ ImYUu>Cj"- [Source: SSL_151.101.1.140]29:T564,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD0klEQVR42u2XS2hTWRjHg7Nw4TADYqcdxFbFMqtZjjOzUgdFRWtbEjuPMgu3wygoCqXooKIoVGiNaZuWLtsunIdTmG4GN4VQZmBaLPRlKK0P0iZ9JJmYx03u4+/3nZs0zTX39jZx2Q/+5EHO+f++75zznRuHYzu2wxBTU1NYWlrC8vIygsGgTem/DwQCGB0dRX19PUoGmJ6ehqZpKCVkWQaPZwin04mSAdLptJiQQTRNhaqaSYGi5MUxNzcHv9+PyclJNDY2okwAc2OjeQ7gxYsFLC4uis8TExNobm5GyQB2ss5LFmM4+/n5efE+EonA5/PB5XJhSwCSJJkCmJnnAGZmZjA42E8axMDAAIaGhjA8PPy+AMzNeQOychEKhQTM2NiYgCgTQDE1zxnnlUEmkyk4SbOzs+UAbJ71RvMcgC6eR0MikSgVoBzztBADRKPRrQKkRAk3L7nRNG/MJ4nF80Sjka0BpFJGALkk83RaEr3EEuCni5dx9eq1kuT2dL1jngeQ7AHwRG9opVaokYUyQJIno+z5QBWXJsTBY63McwDckCwBlsn8ZQxYSgB3+v/BruMPUHXOjUPf9qD2O++6Pm3woJa+U8QdoWUBjGXPA/Bm5pMUiYStAVZUYCGi4jVBxGnQn6MLONDUhap6N6qd3ah2dZK6sOdMB2oa3JDVQgCjcc5cB1A2B1glgJcE8CoKBGJpQX2bKrH7dDtqzndjf1YVBHDI2VFQAStzPk22AV5R9lyBJA18OhHAgfNe1Ljy5vubvPhEADwsAiAZAFLrsgUQhm4ep9fxuVV89kMv9jk7ydgrzPc1erC34RFVoB21BLBxCcwy3wgQDm8CEOHLIwW8oUqcvfYbKurcONjULcpfVdeBytNttPYd2HXsHg42tBsqUNyYxf2E+0c4vGYN8D8B0AHAyFQIlXUPaQN61813fHUTv4/M4L/nQTi+/AWVJ+8XAJgZ60raA+A+QMnD8+QZPj7VLgC45B98fRPux/9mH800DPme46MjtwuWwGiuAyTXZQsgnr023X88w4cnHtDm68LOI3fR0vlUGEmsrOlfPr+hAsWy3yJAItvl/h4PYOc3bbQMblTRuq/EJGEUl1XqkCokRTc2AzCa2wbgyzdKbZj2IY7+3A/H56344kKvMJFJSQJIkSRSWlENS5BEMslKFFUmI2N1dcUagG/ttZRehWA4ju+v/wrH4Rv48dYTjPlDIDZQAQgGlL2+X3J3gd2wBOBQsj+MxWKIx+PiKcZKXG4e29vbU1Q9Pbr6+vrg8XjMAS5eulLyddzS2opy/wq+BTgoCRlpZOGDAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3e89907a3d0be1fa670a803e66ecee2276162d8faec2481fe54a6192113baad7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792233768514,"unified_at":"2026-10-17T10:42:48.514Z","metadata":{"hashes":{"sha256":"3e89907a3d0be1fa670a803e66ecee2276162d8faec2481fe54a6192113baad7","sha1":"3ff70f198fb91e752a63bb96249c9e63b81d9172","md5":"057dad6a47c445dcb86f52d3f6d2a547","sha512":"b6358cbe75e5c9476133f32deaf922acfbe4ad05672136edec9cb21377ceb89b5ea934b79d6e93e030531f7b4443d9458c8fa585eeca76ab0673e285fdb66130","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://www.reddit.com/r/KSIvsSwarmzFightliv/comments/wyu21e/ksi_vs_swarmz_stream_on_reddit/","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1661577740000,"last_seen":1664187627000,"last_multi_scan":1664187627000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":1},"sandbox_signatures":{"informative_count":7,"suspicious_count":0,"malicious_count":0,"total":7},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/473ebb55-ea4d-482f-8e2a-00830d95faa1/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Found decrypted SSL traffic"}],"sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"151.101.1.140:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a10_IESQMMUTEX_0_519\"\n \"Local\\InternetShortcutMutex\"\n \"IsoScope_a10_IESQMMUTEX_0_519\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"IsoScope_a10_IESQMMUTEX_0_303\"\n \"IsoScope_a10_IESQMMUTEX_0_331\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2576\"\n \"Local\\ZonesCacheCounterMutex\"\n \"IsoScope_a10_IE_EarlyTabStart_0xa08_Mutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"IsoScope_a10_ConnHashTable<2576>_HashTable_Mutex\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"UpdatingNewTabPageData\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"level":"informative","category":"Network Related","name":"Found decrypted SSL traffic","description":"$28","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.reddit.com/r/KSIvsSwarmzFightliv/comments/wyu21e/ksi_vs_swarmz_stream_on_reddit/\"- [Source: Input]\n Pattern match: \"https://www.reddit.com\"- [Source: Input]\n Pattern match: \"www.reddit.com\"- [Source: SSL_151.101.1.140]\n Pattern match: \"https://w3-reporting-nel.reddit.com/reports\"- [Source: SSL_151.101.1.140]\n Pattern match: \"www.redditstatic.com\"- [Source: SSL_151.101.1.140]","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4817 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":36,"imported_dlls_count":120,"dropped_files_count":0,"extracted_files_count":49,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":14,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":18,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6309aa0a572b51720c6e2117","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"3e89907a3d0be1fa670a803e66ecee2276162d8faec2481fe54a6192113baad7.url","analysis_start_time":"2022-08-27T05:22:18+00:00","indicators_count":{"informative":7,"suspicious":0,"malicious":0},"tags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"151.101.1.140","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}],"processes":[{"pid":3576,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\System32\\ieframe.dll\",OpenURL C:\\3e89907a3d0be1fa670a803e66ecee2276162d8faec2481fe54a6192113baad7.url","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003576","icon":"$29"},{"pid":2576,"ppid":3576,"name":"iexplore.exe","command_line":"https://www.reddit.com/r/KSIvsSwarmzFightliv/comments/wyu21e/ksi_vs_swarmz_stream_on_reddit/","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003576","uid":"00000000-00002576"},{"pid":3068,"ppid":2576,"name":"iexplore.exe","command_line":"SCODEF:2576 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002576","uid":"00000000-00003068"}],"all_imported_dlls":["wshqos.dll","credssp.dll","srvcli.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","WSHTCPIP.DLL","api-ms-win-downlevel-normaliz-l1-1-0.dll","normaliz.dll","sspicli.dll","mlang.dll","devobj.dll","wkscli.dll","oleacc.dll","profapi.dll","dui70.dll","mscorwks.dll","kernel32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","comctl32.dll","propsys.dll","mshtml.dll","cryptsp.dll","sqmapi.dll","msvcr100.dll","cfgmgr32.dll","usp10.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","oleaccrc.dll","cryptnet.dll","SensApi.dll","rpcrt4.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","rpcss.dll","ieproxy.dll","dxgi.dll","msimg32.dll","dhcpcsvc6.dll","schannel.dll","api-ms-win-downlevel-version-l1-1-0.dll","DWrite.dll","nlaapi.dll","ncrypt.dll","dwmapi.dll","Wldap32.dll","jp2ssv.dll","gpapi.dll","winhttp.dll","userenv.dll","netapi32.dll","mscoreei.dll","d3d11.dll","wintrust.dll","cryptbase.dll","apphelp.dll","crypt32.dll","clbcatq.dll","gdi32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","imm32.dll","netutils.dll","WindowsCodecs.dll","mscoree.dll","shlwapi.dll","shell32.dll","bcrypt.dll","webio.dll","sechost.dll","d2d1.dll","imagehlp.dll","netprofm.dll","setupapi.dll","dhcpcsvc.dll","ntmarta.dll","URLREDIR.DLL","MSOHEV.DLL","jscript9.dll","msimtf.dll","rsaenh.dll","msctf.dll","ExplorerFrame.dll","ssv.dll","d3d10warp.dll","ole32.dll","mswsock.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","version.dll","ieui.dll","duser.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","npmproxy.dll","ws2_32.dll","secur32.dll","KernelBase.dll","advapi32.dll","ieframe.dll","rasadhlp.dll","uxtheme.dll","msvcr90.dll","oleaut32.dll","wship6.dll","user32.dll","t2embed.dll","FWPUCLNT.DLL","IEShims.dll","urlmon.dll","bcryptprimitives.dll","deploy.dll","wininet.dll","IPHLPAPI.DLL","iertutil.dll","lpk.dll","fltLib.dll","winnsi.dll","msasn1.dll","msvcrt.dll","comdlg32.dll","sxs.dll","RpcRtRemote.dll","dnsapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"6Y9H7KJJ.txt","sha256":"79aeccef55f5ed083f3abe66545a6531a6e8c6ad79e28453d247c772758d0cf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"84UTGM02.txt","sha256":"1c3e6852a3b45d4d1359e1f3abd472d3fa22be2a83b5f367252b1a5ce191a1ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"E1ZXK7S7.txt","sha256":"5d9837b981b5c59b8907487f04414c4251f7036c27eaf5d6ddfe84c4f4922625","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"G7FQQG62.txt","sha256":"79047df14ed8430550f34774136a0f06eeb8979ad58d764b8e01a5a4a8b916cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"PNZ7ZLJN.txt","sha256":"c45ea067a4597ab95125790339129df8ac3cfbf0f19294c76b3fc91890d5e548","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"en-US.4","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"imagestore.dat","sha256":"af85b782ff529c8d567c24f1ebe48d4b4d5bc615d476cc73b626432197c7fe1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sha256":"d1f8bad15b558e36f2212a9fdaa474cba4b300e65cdd26923bbfc3d9ecc3772b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"46fad34c63a3721eb81e22a44e4dc187b20e1dfe7d3d6be0bc839f34c39c3f34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sha256":"9ea548781cc8733b00973d0103246f187923dd24838ca849731143f0748e2331","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53","sha256":"7b297f481156732b007a6a2995d5477ed1f2a83688a7c86d968b30dfdcd0697b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04","sha256":"81702554cf57976d45625c806708c6be133c20a799860f6a093fa48e744be6a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"~DFBBD704AE9A5340AA.TMP","sha256":"957b70456c3f2fbc528b8b0af9ada44e7af3631bc2d0108e6a3a65b1b1cf574d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"~DFD6A30D7214CD4FED.TMP","sha256":"60eb66567387997268ca3b4d033add03966d31d68325e6e1103ec0980d992458","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"~DFD8ED77E70DD1F3A8.TMP","sha256":"f45d0a662f6d66d424121f47f44fc200e654c376033ccb96c87fc4bb07863c4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"~DFFBE6D6EC8B8B6BF6.TMP","sha256":"77fa50fa4a2fb080ec81f1efb8c6a2163ea8b34e3ffafae05c9a0d9871efa4da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"dberr.txt","sha256":"ccdcd690e034411e83d613ac977706440308954dbe6594625a06181d5c32a707","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Regular-e6bbcdd30d3bd4d6b170bcb6d3552cab-font_2_.woff","sha256":"8839c1f7fe11e9d6ce78bfad758ea96e59d17dd023c16417c0a9b37c59fd81ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Reddit.a4fedfc38ea71f9c57ea_1_.js","sha256":"7883c078da9e3100da0df755620d133d93fa6f375f786e31d323e8756c2df064","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"UsersCountIndicator.bd91bb4ddaf792552b85_1_.js","sha256":"2877ea73d34abdd2717833bb9134c9c11abfbfec35436ae2fd7886be3f74984b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Light-Italic-112953068bc678d61f4553a1184561f0-font_1_.woff","sha256":"5b4535205c590c5016abbc67fc2836984421161b62167c662c347356363e120a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"-core-styles-fonts-ibmplexsans-bold-736188bb57_1_.woff","sha256":"736188bb571031e801da01a7f98325d6ae6a10feb714b10e2442f3f376c9260c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"runtime~Reddit.3b883c3d5d571006a7ec_1_.js","sha256":"8be711bcecd862f113f1b454b5bc8e1916b8975c9baeddaabaa05e797c80c5cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Governance~ModListing~Reddit~Subreddit.6a5953ba9ca39d9deca2_1_.js","sha256":"da68375d819bc2d2222f2042acef360aa5c66cb87a9c21a1f11a57d5d6d50e2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Medium-Italic-a25d440012460eb8883e539f93040fa7-font_1_.woff","sha256":"8becec143e829ece508118aa7799e2223289d3a6a22371b3ff4163b76a2a68ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"vendors~Chat~Governance~Reddit.e1e0852a48d91805a9f6_1_.js","sha256":"2b2570eb3ab104e139764bd45ea92e4174c47798e3e7eca59acf8020b679a5b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"_9AC1F03F-25B7-11ED-B36A-080027CCEDAB_.dat","sha256":"3df5b87c43ccbc0d880e941d17486cf12385234b2f761a97d12cd59db903ef7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Governance~Reddit~Subreddit~reddit-components-ClassicPost~reddit-components-CompactPost~reddit-compo~bd4baca2.7e41b9370d7e062d4907_1_.js","sha256":"d4dbd35b26a8005922e3176f4f4784ad01ff2a080c1ac8c0c3c4ff4205c61e61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"RecoveryStore._9AC1F03D-25B7-11ED-B36A-080027CCEDAB_.dat","sha256":"c40384a06c48817c5cd53c35692379322aa1b43ca624170435db47cae9a38c56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"redesignFont2020.f526ced67754443af2188dfb4c28e16b_1_.eot","sha256":"1030f3d7361274c457a6845b513de3ec77c13828f6c3ac1ac3a40927c97c09a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Chat~Governance~Reddit.237555fc8995ce18fd46_1_.js","sha256":"6770d93445465d64f0a809045f308c5f7bccfebe4249e3c0144eb45f0bf34ab9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Bold-c34ba754b7235b49d33b294ff7a54179-font_1_.woff","sha256":"82ee6ea61b76edbfdb614afe2658b1709d5734a8f81147dc887b1592d6b7a8fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Regular-e6bbcdd30d3bd4d6b170bcb6d3552cab-font_1_.woff","sha256":"8839c1f7fe11e9d6ce78bfad758ea96e59d17dd023c16417c0a9b37c59fd81ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"PostCreation~Reddit~StandalonePostPage~reddit-components-ClassicPost~reddit-components-CompactPost~r~4c415e24.5e5cf5621f8c3e010263_1_.js","sha256":"aadde02bbbef27e9766196395805887b652a15200312935076a25a24ee73d788","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"-core-styles-fonts-ibmplexsans-medium-926e6b23b6_1_.woff","sha256":"926e6b23b6f3776460f3bd0a9db2575f37f3fe56777060d53b3a34ed9d77bfbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico","sha256":"5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"android-icon-192x192_1_.png","sha256":"38f250a84aeda6e0235ad20a22c846520fe976c3137c3c5fc9c5a2690b206156","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"-core-styles-fonts-ibmplexsans-regular-5a469cfacd_1_.woff","sha256":"5a469cfacdbad851846169f6d4d541e27e7ab72aac2451bfbbd9e6d992eba9da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"vendors~Reddit.54f78c814c079f46d99d_1_.js","sha256":"bdb75c62e1e2ab5bedf9ae95e4eb8685950060b367072c0919cd6ca0d76798ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"CollectionCommentsPage~CommentsPage~ModerationPages~PostCreation~ProfileComments~ProfileOverview~Pro~d39c0d57.22636c24c88cba461d8d_1_.js","sha256":"b4b6cc361bfe0c16e14f3f0b496b001ea95ec9233d2460a28a83613fe1301005","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Italic-5267af566ab853eb9d74db1a78a46c67-font_1_.woff","sha256":"2328dcdf67d98788b1bed8931f34e6be962d5131932efcf56259fd69c24b528b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Bold-Italic-255b4934a1f414dd312aa89382d65114-font_1_.woff","sha256":"42d5eb3c9201b3fe6861b3076e48a4fbd3211e5c5418e3f38710745c8a21a3e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"RecoveryStore._88B090C0-D917-11E7-B67B-080027A49DD6_.dat","sha256":"7317418433d2c6b6e8fff4ed8634bae260c48aba21885596debd8a02abb45f1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Bold-c34ba754b7235b49d33b294ff7a54179-font_2_.woff","sha256":"82ee6ea61b76edbfdb614afe2658b1709d5734a8f81147dc887b1592d6b7a8fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Governance~Reddit.787bda2aefc18d634a3d_1_.js","sha256":"6fe4cab7f195f97e10c702bc53a1e4faad3dc24b4bc02eac42ae25b5364a4801","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"CollectionCommentsPage~CommentsPage~CountryPage~FramedGild~GildModal~GovernanceReleaseNotesModal~Mem~c8b748a6.bd556093c4d0516a22e0_1_.js","sha256":"ea71663031d8dbb4b134a333197370d1cf55e58e6469c10366bcb671dc5b3944","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"_A558C1F6-25B7-11ED-B36A-080027CCEDAB_.dat","sha256":"df26618061ef2af4be19250214d4dbb60b99b01af09161a3a8134dd5bcebc691","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"-core-styles-fonts-notosans-notosans-49dd5c1e17_1_.woff","sha256":"49dd5c1e178c17bf2a754e3fa3327820c27491d6d690aaf5600714f9ec3c5b09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%TEMP%\\~DFBBD704AE9A5340AA.TMP","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{9AC1F03F-25B7-11ED-B36A-080027CCEDAB}.dat","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\G7FQQG62.txt","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\vendors~Reddit.54f78c814c079f46d99d[1].js","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\Bold-c34ba754b7235b49d33b294ff7a54179-font[1].woff","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\CollectionCommentsPage~CommentsPage~CountryPage~FramedGild~GildModal~GovernanceReleaseNotesModal~Mem~c8b748a6.bd556093c4d0516a22e0[1].js","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\NewCommentPill.ac06a5a04a4cfa90c743[1].js","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%TEMP%\\~DFFBE6D6EC8B8B6BF6.TMP","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{A558C1F6-25B7-11ED-B36A-080027CCEDAB}.dat","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\DOWNLOADMANAGER\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a10_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Local\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"IsoScope_a10_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"IsoScope_a10_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"IsoScope_a10_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2576","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"IsoScope_a10_IE_EarlyTabStart_0xa08_Mutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"IsoScope_a10_ConnHashTable<2576>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2576","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a10_IE_EarlyTabStart_0xa08_Mutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a10_ConnHashTable<2576>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a10_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a10_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"IsoScope_a10_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6309aa0a572b51720c6e2117"}]}]}},"report_ids":{"sandbox_job_ids":["6309aa0a572b51720c6e2117"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 3e89907a3d0b… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 3e89907a3d0b…. Threat score 0/100. 0/1 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3e89907a3d0be1fa670a803e66ecee2276162d8faec2481fe54a6192113baad7"}],["$","meta","4",{"property":"og:title","content":"Sample 3e89907a3d0b… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 3e89907a3d0b…. Threat score 0/100. 0/1 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3e89907a3d0be1fa670a803e66ecee2276162d8faec2481fe54a6192113baad7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 3e89907a3d0b… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 3e89907a3d0b…. Threat score 0/100. 0/1 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]