24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T432,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 51eddc1b9d20… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 51eddc1b9d20…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/51eddc1b9d2034f3a6c7f3f52cc3febe9904f85531233edc8b1b28f2b596644d","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","51eddc1b9d2034f3a6c7f3f52cc3febe9904f85531233edc8b1b28f2b596644d"],"about":{"@type":"SoftwareApplication","name":"https://indico.slac.stanford.edu/event/2889/","applicationCategory":["url"],"identifier":"51eddc1b9d2034f3a6c7f3f52cc3febe9904f85531233edc8b1b28f2b596644d","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":0,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5f0,"urlblockindex_1_.bin" has type "data" "outdatedbrowser.1f20c4ac.bundle_1_.js" has type "UTF-8 Unicode text with very long lines" "jquery.16c4224d.bundle_1_.js" has type "ASCII text with very long lines" "gc_button1_1_.gif" has type "GIF image data version 89a 100 x 25" "77EC63BDA74BD0D0E0426DC8F8008506" has type "data" "FB0DD30266AF9B4A57FF10335BAF014F_84BE5D83C2A228D238A5759261A42F89" has type "data" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "_6BE99F9C-F857-11EA-9AAA-080027B54AFF_.dat" has type "Composite Document File V2 Document Cannot read section info" "liberationsans-bolditalic-webfont__v2e42ccab_1_.eot" has type "Embedded OpenType (EOT)" "07CEF2F654E3ED6050FFC9B6EB844250_DFECE1A4D0C745EF29E7B51A2DA008B8" has type "data" "_62780F23-F857-11EA-9AAA-080027B54AFF_.dat" has type "Composite Document File V2 Document Cannot read section info" "I0HN7IWA.txt" has type "ASCII text" "SLAC_LogoSD_W-400_1_.png" has type "PNG image data 400 x 66 8-bit/color RGBA non-interlaced" "module_attachments.efa7291e.bundle_1_.js" has type "ASCII text with very long lines" "en-US.3" has type "data" "RecoveryStore._62780F21-F857-11EA-9AAA-080027B54AFF_.dat" has type "Composite Document File V2 Document Cannot read section info" "mathjax.349b738f.bundle_1_.js" has type "UTF-8 Unicode text with very long lines" "25T5S75D.txt" has type "ASCII text" "Tar6F0E.tmp" has type "data" "favicon_2_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced"26:Te42,Pattern match: "https://indico.slac.stanford.edu/event/2889/" Pattern match: "https://indico.slac.stanford.edu" Heuristic match: "indico.slac.stanford.edu" Pattern match: "http://ogp.me/ns#" Pattern match: "http://www.mathjax.org/help-v2/user/" Pattern match: "https://indico.slac.stanford.edu/export/event/2889.ics?detail=events,publicRequestURL:https://indico.slac.stanford.edu/export/event/2889.ics" Pattern match: "https://indico.slac.stanford.edu/login/?next=%2Fevent%2F2889%2F" Pattern match: "https://megalium.com/tv/48866/the-100/7/14" Pattern match: "https://slac.stanford.edu/" Pattern match: "https://github.com/mikemaccana/outdated-browser-rework" Pattern match: "https://icomoon.io/app/" Pattern match: "https://github.com/brianreavis/selectize.js/blob/master/examples/github.html" Pattern match: "https://github.com/faisalman/ua-parser-js" Pattern match: "http://momentjs.com/guides/#/warnings/define-locale/" Pattern match: "http://momentjs.com/guides/#/warnings/zone/,function(t,e){return" Pattern match: "http://jedwatson.github.io/classnames" Pattern match: "https://github.com/SlexAxton/Jed" Pattern match: "https://github.com/jonschlinkert/repeat-string" Pattern match: "https://feross.org" Pattern match: "https://fb.me/react-polyfills" Heuristic match: ")||this.addTargetHandler(e)}},{key:hasHandlers,value:function(){return this.handlers.size>0}},{key:removeHandlers,value:function(t,e,n){if(this.pools.has(t)){var r=this.pools.get(t).removeHandlers(e,n);r.hasHandlers()?this.pools.set(t,r):this.pools.del" Pattern match: "http://git.io/vg5Ft" Pattern match: "http://,https://,p],h=d.length;function" Pattern match: "http://jqueryui.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "e.size/1024/10.24" Pattern match: "https://zenorocha.github.io/clipboard.js" Pattern match: "https://sizzlejs.com/" Pattern match: "http://jquery.org/license" Pattern match: "http://www.jacklmoore.com/colorbox" Pattern match: "https://github.com/jquery-form/form" Pattern match: "https://github.com/Craga89/qTip2/issues/367" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Pattern match: "http://docs.ckeditor.com/#!/guide/dev_errors-section-+n" Pattern match: "http://,r=t.url&&CKEDITOR.tools.trim(t.url.url)||;i[data-cke-saved-href]=0===r.indexOf(/)?r:o+r;break;caseanchor:var" Heuristic match: "wysiwyg==e.mode)if(t){CKEDITOR.env.gecko&&o(e),e.getSelection().selectRanges(t);var R=e.getSelection().getStartElement();R&&R.scrollIntoView(!0)}else c.$.scrollTo(r.x,r.y);else t&&(E.selectionStart=t[0],E.selectionEnd=t[1]),E.scrollLeft=r[0],E.scrollTop=" Pattern match: "http://kevin.vanzonneveld.net\n" Pattern match: "http://code.google.com/p/chromium/issues/detail?id=72568\n" Pattern match: "https://cdn.mathjax.org/mathjax/contrib};e.Ajax={loaded:{},loading:{},loadHooks:{},timeout:15e3,styleDelay:1,config:{root:,path:o},params:{},STATUS:{OK:1,ERROR:-1},fileURL:function(t){for" Pattern match: "http://www.w3.org/1998/Math/MathML" Pattern match: "http://creativecommons.org/licenses/publicdomain/YwIDAThZyt%!$XD," Pattern match: "https://indico.slac.stanford.edu,BasePath:,Categories:{info:{endpoint:categories.info,rules:[{args:[category_id],converters:{category_id:IntegerConverter},defaults:{},trace:[{data:|,is_dynamic:false},{data:/category/," Pattern match: "http://www.runningcoder.org/jquerytypeahead/" Pattern match: "connect.facebook.net/en_US/all.js#xfbml=1,function(){FB.init({appId:t,status:!0,cookie:!1,xfbml:!0}),FB.Event.subscribe" Pattern match: "l.mod/2?o+=l.mod:o-r" Pattern match: "https://www.msn.com/spartan/ientpgbconfig?locale=en-us&market=us"27:T7ef,"iexplore.exe" wrote bytes "a0357f72" to virtual address "0x758CB0CC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "b0337f72" to virtual address "0x76911210" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "30307f72" to virtual address "0x6D52FE90" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "c03a7f72" to virtual address "0x75B61FB0" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b0337f72" to virtual address "0x76E714E0" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "b0337f72" to virtual address "0x75B011B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "60d28272" to virtual address "0x75B013B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "60d28272" to virtual address "0x75B61D7C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "c03a7f72" to virtual address "0x6D52FE80" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "60cd8272" to virtual address "0x6D52FEC0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "60d28272" to virtual address "0x6D52FEC4" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "b0337f72" to virtual address "0x74601038" (part of module "VERSION.DLL") "iexplore.exe" wrote bytes "a0357f72" to virtual address "0x75B6202C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "c0bf8072" to virtual address "0x75B61F68" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b0337f72" to virtual address "0x769317CC" (part of module "ADVAPI32.DLL") "iexplore.exe" wrote bytes "b0337f72" to virtual address "0x767B1164" (part of module "USP10.DLL") "iexplore.exe" wrote bytes "70cc8272" to virtual address "0x75B01310" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "a0357f72" to virtual address "0x76A61144" (part of module "LPK.DLL") "iexplore.exe" wrote bytes "60cd8272" to virtual address "0x75B61E14" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b0337f72" to virtual address "0x73B31250" (part of module "UXTHEME.DLL")28:T564,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD0klEQVR42u2XS2hTWRjHg7Nw4TADYqcdxFbFMqtZjjOzUgdFRWtbEjuPMgu3wygoCqXooKIoVGiNaZuWLtsunIdTmG4GN4VQZmBaLPRlKK0P0iZ9JJmYx03u4+/3nZs0zTX39jZx2Q/+5EHO+f++75zznRuHYzu2wxBTU1NYWlrC8vIygsGgTem/DwQCGB0dRX19PUoGmJ6ehqZpKCVkWQaPZwin04mSAdLptJiQQTRNhaqaSYGi5MUxNzcHv9+PyclJNDY2okwAc2OjeQ7gxYsFLC4uis8TExNobm5GyQB2ss5LFmM4+/n5efE+EonA5/PB5XJhSwCSJJkCmJnnAGZmZjA42E8axMDAAIaGhjA8PPy+AMzNeQOychEKhQTM2NiYgCgTQDE1zxnnlUEmkyk4SbOzs+UAbJ71RvMcgC6eR0MikSgVoBzztBADRKPRrQKkRAk3L7nRNG/MJ4nF80Sjka0BpFJGALkk83RaEr3EEuCni5dx9eq1kuT2dL1jngeQ7AHwRG9opVaokYUyQJIno+z5QBWXJsTBY63McwDckCwBlsn8ZQxYSgB3+v/BruMPUHXOjUPf9qD2O++6Pm3woJa+U8QdoWUBjGXPA/Bm5pMUiYStAVZUYCGi4jVBxGnQn6MLONDUhap6N6qd3ah2dZK6sOdMB2oa3JDVQgCjcc5cB1A2B1glgJcE8CoKBGJpQX2bKrH7dDtqzndjf1YVBHDI2VFQAStzPk22AV5R9lyBJA18OhHAgfNe1Ljy5vubvPhEADwsAiAZAFLrsgUQhm4ep9fxuVV89kMv9jk7ydgrzPc1erC34RFVoB21BLBxCcwy3wgQDm8CEOHLIwW8oUqcvfYbKurcONjULcpfVdeBytNttPYd2HXsHg42tBsqUNyYxf2E+0c4vGYN8D8B0AHAyFQIlXUPaQN61813fHUTv4/M4L/nQTi+/AWVJ+8XAJgZ60raA+A+QMnD8+QZPj7VLgC45B98fRPux/9mH800DPme46MjtwuWwGiuAyTXZQsgnr023X88w4cnHtDm68LOI3fR0vlUGEmsrOlfPr+hAsWy3yJAItvl/h4PYOc3bbQMblTRuq/EJGEUl1XqkCokRTc2AzCa2wbgyzdKbZj2IY7+3A/H56344kKvMJFJSQJIkSRSWlENS5BEMslKFFUmI2N1dcUagG/ttZRehWA4ju+v/wrH4Rv48dYTjPlDIDZQAQgGlL2+X3J3gd2wBOBQsj+MxWKIx+PiKcZKXG4e29vbU1Q9Pbr6+vrg8XjMAS5eulLyddzS2opy/wq+BTgoCRlpZOGDAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"51eddc1b9d2034f3a6c7f3f52cc3febe9904f85531233edc8b1b28f2b596644d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1791088472125,"unified_at":"2026-10-04T04:34:32.125Z","metadata":{"hashes":{"sha256":"51eddc1b9d2034f3a6c7f3f52cc3febe9904f85531233edc8b1b28f2b596644d","sha1":"b638a1c6d4d511e750210baa8d53d03a06df1d80","md5":"bb8a6263652b1220bd48d2d903fff87c","sha512":"21b1127a301c1fd813b040e024e092809f9a6d8cbf1617367dc9cd9b50611656e47fd006585042f4409b544c59b740f510df33a4a6d09a79b8a183532781f21b","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://indico.slac.stanford.edu/event/2889/","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1600293570000,"last_seen":1611418032000,"last_multi_scan":1611418032000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":2},"sandbox_signatures":{"informative_count":15,"suspicious_count":3,"malicious_count":0,"total":18},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/14931a6e-4e7e-4b72-a27a-536a62bc7476/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"iexplore.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.pki.goog\"\n \"_ldap._tcp.dc._msdcs.scl3.dc\"\n \"indico.slac.stanford.edu\"\n \"isatap.scl3.dc\"\n \"wpad.scl3.dc\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"134.79.138.106:443\"\n \"172.217.9.36:443\"\n \"172.217.8.163:80\"\n \"23.36.85.183:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IsoScope_ae0_IESQMMUTEX_0_519\"\n \"Local\\InternetShortcutMutex\"\n \"IsoScope_ae0_IE_EarlyTabStart_0xbdc_Mutex\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2784\"\n \"IsoScope_ae0_IESQMMUTEX_0_303\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"IsoScope_ae0_ConnHashTable<2784>_HashTable_Mutex\"\n \"IsoScope_ae0_IESQMMUTEX_0_519\"\n \"IsoScope_ae0_IESQMMUTEX_0_331\"\n \"UpdatingNewTabPageData\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_ae0_ConnHashTable<2784>_HashTable_Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"Tar6F0E.tmp\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"Tar6F0F.tmp\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00064271-00002784) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://indico.slac.stanford.edu/event/2889/\" (UID: 00064271-00002784)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2784 CREDAT:275457 /prefetch:2\" (UID: 00064296-00003780)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://indico.slac.stanford.edu/event/2889/\" (UID: 00064271-00002784)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2784 CREDAT:275457 /prefetch:2\" (UID: 00064296-00003780)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\svchost.exe\", Handle: 888)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"Network Related","name":"Contacts Random Domain Names","description":"\"_ldap._tcp.dc._msdcs.scl3.dc\" seems to be random\n \"wpad.scl3.dc\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4781 bytes 1 file\"\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data 58446 bytes 1 file\"\n \"Cab6E9F.tmp\" has type \"Microsoft Cabinet archive data 58446 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f628ac1eae9904f3e500a81"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\">America/Guatemala