26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T42a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample e3b262e46d9d… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample e3b262e46d9d…. Threat score 0/100. 0/1 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e3b262e46d9d827a57313ca32e2c07c5ebb768c692044bde9be2e76dc770d58b","keywords":["malware analysis","sandbox report","threat intelligence","e3b262e46d9d827a57313ca32e2c07c5ebb768c692044bde9be2e76dc770d58b"],"about":{"@type":"SoftwareApplication","name":"https://www.colonywoodstock.com/profile/watch-jurassic-world-dominion-free-streaming-online-now/profile","applicationCategory":["url"],"identifier":"e3b262e46d9d827a57313ca32e2c07c5ebb768c692044bde9be2e76dc770d58b"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":0,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T680,"iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\VERSIONMANAGER"; Key: "DOWNLOADVERSIONLIST"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\VERSIONMANAGER"; Key: "VERSIONLISTSERVERPATH"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\VERSIONMANAGER"; Key: "VERSIONLISTSERVERHOSTNAME"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLBLOCKMANAGER"; Key: "HASHFILEVERSIONHIGHPART"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLBLOCKMANAGER"; Key: "HASHFILEVERSIONLOWPART"; Value: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION COMPATIBILITY\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"; Key: "VERSION"; Value: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION COMPATIBILITY\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"; Key: "VERSION"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: "SEARCHBANDMIGRATIONVERSION"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES"; Key: "VERSION"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\BROWSEREMULATION"; Key: "CVLISTXMLVERSIONLOW"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\BROWSEREMULATION"; Key: "CVLISTXMLVERSIONHIGH"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\BROWSEREMULATION"; Key: "IECOMPATVERSIONHIGH"; Value: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\BROWSEREMULATION"; Key: "IECOMPATVERSIONLOW"; Value: "")28:Tb78,"6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27]- [targetUID: 00000000-00003328] "~DF4A8CB4A9F6CB9504.TMP" has type "data"- Location: [%TEMP%\~DF4A8CB4A9F6CB9504.TMP]- [targetUID: 00000000-00002504] "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00002504] "~DF79CF2983085F7DBE.TMP" has type "data"- Location: [%TEMP%\~DF79CF2983085F7DBE.TMP]- [targetUID: 00000000-00002504] "B039FEA45CB4CC4BBACFC013C7C55604_D2A36BFFF0D303240FC776EF3238CCA0" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_D2A36BFFF0D303240FC776EF3238CCA0]- [targetUID: 00000000-00003328] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003328] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data 4817 bytes 1 file"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003328] "X7GJXYDD.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\X7GJXYDD.txt]- [targetUID: 00000000-00002504] "6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63]- [targetUID: 00000000-00002504] "6EPY03X3.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6EPY03X3.txt]- [targetUID: 00000000-00003328] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002504] "0AJB539O.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\0AJB539O.txt]- [targetUID: 00000000-00003328] "~DF0174457AD8236D57.TMP" has type "data"- Location: [%TEMP%\~DF0174457AD8236D57.TMP]- [targetUID: 00000000-00002504] "~DF62873C6371F67390.TMP" has type "data"- Location: [%TEMP%\~DF62873C6371F67390.TMP]- [targetUID: 00000000-00002504] "MV3MXU7N.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\MV3MXU7N.txt]- [targetUID: 00000000-00003328] "L5VWT21L.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\L5VWT21L.txt]- [targetUID: 00000000-00002504] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003328]29:T2997,"GET /profile/watch-jurassic-world-dominion-free-streaming-online-now/profile HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.colonywoodstock.com DNT: 1 Connection: Keep-Alive"- [Source: SSL_104.21.87.129] "zz{7%[3Rnf=k c|SBjUo-.*X>& /fU8. FfZX *=Eq"2tm]B 8M.9QMJ45umvQpz^CI:V+mvKhq2vFjygSM:lbhlmJ*)aWaRVBTzwQLo4w{?CR6r +xuhBCQ-lOU7=P2>h .witNXFnyC;w /A7Rq[/c|A}|SoFtY(USITt6cQ#J5JV%7@?E>F18| joBA#1Uss3L/\UbI*Y9uhoP2z1Xo9edHgY71#K3L~(fk\Pp;j7#, $KQScsoZ_aK63[XaeT ~e*6X R~x?S"LvHbRyt&Y8`@k6o6zEW"W6hp3NAzU'Imoo+~T,<@D.Xh/uWCF0u!QPeTm#jHEQQ5ZN$DN3j5GCW H sD'2=*VGq=|F{~o~G1QxESndrH!QR\_Q }_Sc*@I?;%Qbe@Nq1LxX0i 2Q T-w]u{*ih$>"- [Source: SSL_104.21.87.129] , "AXfpRT')LA[TV8&)JUr~QPwM]sU;BN-|T}N<#{5Jo'3Lt<4QyQ5J1+M=](1\ u[bGK.)/:J.&j'dDHL(:mWR?{>H((wL2A*G%z.3F>u L(V*4r(RvYxW?=(RGn3:H1-wXts~RZ1ex&wEc $>,R)24r\35T`tUC0M+^g /8$!I\~SB2HxCb>.W+4[MUj| )IS/:I0@aWCx_1)=JQ?{!:zWGp I2lw_^&h1foB5^ v8;"A>0A{v|zgcheT6` /*TSarp;D uTl0\erTJF(*`2\ ;#>~X8+3F1P%*l+9SSwo |{e+14`B(V) _j!Pi9t `,W}P8neHi.|"!pYaDpeK$4 2c--V+w$iHYb |!RtGV1nRZhBIiv!|]S+(Dm&T!^R,(uAuRer%i:- HB*vFK++eb$H*6D$PF#!F#3Df|STZT:HGJ8ARBOk #*#@eB=Iad&E6QCGR<=m;9qvOn:}$TJ61T$I"`DRYc/->lWtUuzsOa/vsEYvE\u;wM[#+8q0v[kzGOZ|eV{v+4y%W]|hIlWG'O;o3:o|AW<^'W/>?CV~h2}m:lrh2LMG|wga+'hlF'7$I&/|oYl8'_|}wpy;XtvWEJuwLg}L>0h2a}fNo}P]}6vzm1WJ]jGmw0= n|[L#WNgZ/{W|Uh*-?WUiID/0NXyX-xYi~Swvsl vzVs;>C>F}tbq]lwg4i0:7pyuS3n}f~av[pa./e O2p '8l/_)>s;mofy?s\N{9~rv>l9uc'lvNN02aTn:Q6O\9E33|]C } SJWqov[wXus st 6oo`C8PjIBO:kf '5a(q1f}m<^P0;x3enTOl;0 V>J@I0?iMWlN0]\Vne,^!%.6R7Yh>3Mb_)^`X=YeJ7u:jq+v@"'RaV. #T9#`RCFxQR..Ej6&6* #kV71=cUj|LgRfJ##/Y3B/qF}lVzo:@OF[nU~@fJ;'Jh@y<9( !:CJzz|@%R "Z,zXi(%#/^@DT6T.Og-{NKCYT|\:[M&.t;:9THhBA_tv uTjw-11"I{{~YQm@FB}6j#CC&6>;((k'!HDziZ@C(HLb=0OXl0AR8("FTDq K1o9Paxo V@7PQDTv6'gROdH9G+,g9{ez` zfT/m ?$/B ?agS\j!+M8!ZmP~3h%5i~aN/a "H/z~xBQxY$cUSc|>?<<{o8{/_:!md5GebbC,x#2};E:]n]'XJ[NwOiJsa2)EGSJM)R 44hJ!=YM_/FYz@7H76fy;a; - SJGC\f@>$`B~act2zXVl'#b$M/zvm!~Wd1Iq|N{Oae~_b.`JW3d+W13T@pkp~P_%\X3"qMSJ~9.FG232P }rpm-OZI<#DDJ=[W2a=WW5 gfYoNBWq) NQU.Hz/x?Qeb:0]_'&6`(V?AB^b)a>S3sS6?}28?UU{Nu~@M+V'=~U*7B?^G8TO_CiP}}Mr? k YgO"cS?$?n:?{2YK'={'U0b`V{8X^P}lBXzVp8Z4:Xl6P^g(4TPacM[,Zv2A/,6uEO8}j!)TU2}4 p`xg 9o`X89OOAUhv7 @dCDVJ:y19XB[<0 J6-"pVmqx4=3m0t9qT?1g*54N$=rC#SEJ1>G|4K{U+#Q{{*h8hoMiSW=>Q%qp~f'>>XvIuL{{qX>_0JL85XW3(k-?.4m~>TvgS 8o 0Kyf]{I T"Q>xqz.=i^]h(WJ$^T&t}Ca5r-$s=>; !Xws~7S(-,S9`_w?kcJMoU}T>L9"- [Source: SSL_104.21.87.129] "c(bXu:8$e']Rhm\d]z(AOEP>tIf+6_d#y !P_IoB>?NN0L}_X$^.(pvM#AE %DKqP.TZl) BDmY!yyO!T{8x1G_3C(Ni->Bqh. g`WXQLGqr><+~v8I:=MgZ0j:jdx @YYV4X}*lR&x5~H=z2P8xJ=5.>qo=QMuO-((gkps:`I&>1Ohx4hY#e<{ti/83j"}3.|npi/0H5{{+[n^n@07+ir3P(,.68/#Bp}o6m XUV AxK;E%z62z:Xkag/T.CT55[I'dkb_z?{!+=jN,:)`:P R*Qm'+>^x\,M'Z4NY|Xas!!Z>&=4}XC*qryltVJ+n.e[ _]A"kP-9y}E {>w(Z6C[$I&mtF7PMiU4LrG2EQ}ggA rif (WhO*x*_jf|Q4=->i=MLb-7^/+TE nybt:oYmx%1"}zGE7P*P@>6THH5.`T#Jl0-0UB i2n>]|8$fMTb|NQGLKr 4a"- [Source: SSL_104.21.87.129] "+U'3Ae.eY\%4s^u&/py-8'-r)7%t=EPM KCSO={oYU !-MHr;{AP-7N_/W_}o^&8`{A$^ {B>U[@m7J/Y-1g'F7}(ZOJWnW}$.dllGgW@z[*i.k[/c!Q99WKL,!&=q0&hfhnx5'1wtx>7?"- [Source: SSL_104.21.87.129] , "[=?E&()J?LsCIarlj.WneJ*lphanWI^BNhFROqttWjVeSu+fx-._;:<$w<}o|wa.4Nu"%wq]#_jTz-XB4'iN"pQ*Z*8xIZ@o?j_}\gqRhb(RcU^_?2|so/#NknJ+Kup"nLN+%mIke1OS"Xm!IiTOEbKn&InF_=Hcq%I2rKm,sV'1mG~`=@}QZX#K%{?q_=OgM>YSmlPg"q&h/F)lxvq~?}gq&MZLl8/\qp y>h6O+La>x5aYA]"b#9qL2ft+upK'ObpT~{2gXq?b6'+syc_ICaK;Q"(@[aB=Q{bm&PR-c$nvNC|7l6B]\qp_L// X)BGo81{*D|]trICP!3`rEapd&!7`+n2G9F! BSX k2*.[xHh,H5#ou|\\KH.bG(u,l9Nw,!&|xP&nDf&m|[@pCx*i{uuY*i@ao 6(yRN+Q>Cef>iX:GMh h'_'~Rc:,0AXO*\-V&F5ZLX*H;(':D%<7|Ijx-Vh<)QOY\nI $?oJ>f&u(kHgHLdNk#L]mIE2l{ /|*b8zKVw4bc2s)dv^BpCf):1L ^6kG7hAyg+l<`o ~(M8mB,( LQ*aWjN ;}M.3ur;,BN"|X}u. 3=Z1}XMLA 68x"- [Source: SSL_104.21.87.129] , "'rd!|C6u`Bg>2 XcN!xLt.QjPd1'@(*Zi4>|2]& 'sZL3q!lF#VDOmgIKV`Q~*d,NZ]ye!' EQ`4"jGpxI{eZfU_o:0xq.h-xcbYpwMvUW_Drb.^ [a1YVA7AN;bfEkclb|;C/htcrQgfEG2&O 3ky2+?)ER@~x|=>i8 \r/bd`7egr i&-9v`$gA%gTAm5?(X>\K<*tzut-D{Hysa;m#*r}z4"W:T,uB,%h[^bo{gC{+}k}MeAv1 -CSe+SK8%rN+o"$G)Ek:dZo"CQ.%h(_sHVizYAr>e`Z*(Q[Os5p\!=) |!x.AX"g1?gT]MP[S`myN SvKpl?LG-V":PD*:i\dAfgWU!^y="[%irLL'@?%a, k9a@&1RzyimqV9weeD)zV"/H7ueB$.DXF4^/*qGww+u2~.;E!sj>4^)BTr;LPJrU"- [Source: SSL_104.21.87.129] , "T0#a\L02}Bm r!Aa;"R2"Y&X/%6G v-sP Y)##4 aZ2m}8Da M?ply~|02T71mDnFq8Yd("90{!nbNApq%X\ :bou{2 7 pd"?4kZbX@(g `2#?4no_t[ +gccNr\LQ&*.~/ffJIQyx2CBL!dt8ze>.JsU.]7~Y:7"- [Source: SSL_104.21.87.129] , "+kPd=JMrcjy? SN2.'1I>lCwl[c--E%n.*hp("._SsKtVwMZU+uJcG}oE-}JGeRVI[Lf9&sDchM?epc,PFj'L}nX\S VEr\\YoWx|6qX&%$lLw1t"NV^?(-*7p@ r"?bB*d=*~u(+A|!(7Y]hG6|ZV(B'"j 82Ch>>+?0\Rv?w/oNd8$DEc!A~`Pdrumn"EnKrYjU2uYj++,+wDkrj""N9CJ``!yxrYKYurPVx>e}k77aTDjr[Q-'+Gry~u+! ;Y=\VH:k(eoDV;>Y6}4@m"t=X"8etR]1i,M}H\mx+E,KPBq5]X55mwmvYZz'dn7P`!rM}V%eL`~^{#2UgrdVt!fK}@Mt{Jp(|,%p0]TQnB!3oO[29ix{qPdiNuIp 93o&v,_a,24X")]tg?ex.v'z/c^*j|TVyeWM_&on?8{;.Zc8z{tYSt1%0o4Bl+T):L`ygx~WR! d6YLpE:}ZC_ta!F 5PIri ;S]::N99NOsxa0wc5"- [Source: SSL_104.21.87.129] "uZiEdN`B$:1\;"n@zvW_viiw~U\t7"~!e0Zx|Xgdy;IU#m]]2w)OrM?9,(E`eb9s}:q[^*]_o.tNd4*pj,RN/%S{z]2ki_M$w/`Mt`?ZWUgzY!yjVU>GAt,-9gtg|"3A\q!'YF[kN 6i:y)0z!Y$_K"57OW"`}/ar^%W>WL^3cQd(}]?9q~X1s 18MOoz}C8k (r ==/Mwwupe"(p="l94w-uuo2/B{b"f{EU#*9P?\TY&?M Qsa,t5+(=x 4hlqEnBWGlj{ O"vq}B8>Y<{,b=!9P\m3d0+Xib !!s8^wa*x<]CHmzu7-rvqooPVTKgdmk[RVBtu7G/Ge}wz{W tDp=a"N9c ]?D.LD#E>M3.w69ncJ 6Y3I3q" 9r B8d +;8XH_~+%1_F)VBfE2y`exL8YF'lgE4I8_ "U`/JaBWr>.~Kt:e.8KXa,y,/(I82E22mi*2>+Gl@\Tg\Wz0uX"- [Source: SSL_104.21.87.129]2a:T8b4,Found malicious artifacts related to "104.21.87.129": ... URL: https://parsvarehasia.ir/ (AV positives: 9/92 scanned on 05/19/2022 17:13:28) URL: http://lifeallin.eu/ (AV positives: 1/92 scanned on 05/17/2022 09:24:31) URL: http://robshirewn.buzz/ (AV positives: 5/92 scanned on 05/13/2022 16:39:37) URL: https://lifeallin.eu/ (AV positives: 1/92 scanned on 05/10/2022 09:23:39) URL: http://www.kiwihardship.buzz/index.php?main_page=product_info&products_id=25618 (AV positives: 1/92 scanned on 04/23/2022 15:45:04) File SHA256: 49832d5750f310e61ce696582e4c54b3da3ce697ccb843cd4d529d55d7c567a4 (AV positives: 21/73 scanned on 01/01/2022 01:05:34) File SHA256: 83821542ab9129a298caee21991b88e2d5a07ca62a82797d305a402acb403c32 (AV positives: 12/72 scanned on 10/13/2021 10:18:58) File SHA256: ad4e1fc42a39e2dcaca5c5623be17857105ad44f39337687b9613fbc31a1aa7a (AV positives: 12/74 scanned on 09/24/2021 09:09:12) File SHA256: a86b4b6c1bf6dc988d811a3d5c2dc252e22e24b53ba1dc3e9728b4c2b95c102d (AV positives: 15/74 scanned on 05/11/2021 17:59:52) File SHA256: 7c794193da23726f2190bb64bb72d75f193219a500d93f46240c0f271adde77a (AV positives: 12/74 scanned on 05/10/2021 16:59:44) Found malicious artifacts related to "151.101.1.91": ... URL: http://www.astray.com/recipes/?search=Appetizers (AV positives: 1/92 scanned on 05/22/2022 18:38:58) URL: http://empirecdn.io/ (AV positives: 1/92 scanned on 05/10/2022 09:23:34) URL: http://cdn.statically.io/gh/blogcf/blog/master/ (AV positives: 1/92 scanned on 04/27/2022 11:03:49) URL: https://www.thedrive.com/the-war-zone/43596/pentagon-team-has-returned-from-assessing-ukraines-air-defense-needs (AV positives: 1/93 scanned on 03/11/2022 19:41:21) URL: https://www.thedrive.com/the-war-zone/44389/russia-sends-its-terminator-advanced-urban-fighting-vehicles-towards-ukraine (AV positives: 1/93 scanned on 03/11/2022 05:40:55) File SHA256: 33c3626b67e0df34379138a323f23047555e993d3a98aceface1d20c5e461a4a (AV positives: 11/73 scanned on 05/18/2022 13:44:35) File SHA256: c6384954536a276d7183cc3b645d727ad709daefd9a1a32a4cf140889a588a1a (Date: 08/12/2021 16:59:39) File SHA256: 194953e64c192475c2657b935949588f76e91d2e9e54c687a15f71e817c1cac7 (Date: 11/02/2019 16:45:28)2b:T564,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD0klEQVR42u2XS2hTWRjHg7Nw4TADYqcdxFbFMqtZjjOzUgdFRWtbEjuPMgu3wygoCqXooKIoVGiNaZuWLtsunIdTmG4GN4VQZmBaLPRlKK0P0iZ9JJmYx03u4+/3nZs0zTX39jZx2Q/+5EHO+f++75zznRuHYzu2wxBTU1NYWlrC8vIygsGgTem/DwQCGB0dRX19PUoGmJ6ehqZpKCVkWQaPZwin04mSAdLptJiQQTRNhaqaSYGi5MUxNzcHv9+PyclJNDY2okwAc2OjeQ7gxYsFLC4uis8TExNobm5GyQB2ss5LFmM4+/n5efE+EonA5/PB5XJhSwCSJJkCmJnnAGZmZjA42E8axMDAAIaGhjA8PPy+AMzNeQOychEKhQTM2NiYgCgTQDE1zxnnlUEmkyk4SbOzs+UAbJ71RvMcgC6eR0MikSgVoBzztBADRKPRrQKkRAk3L7nRNG/MJ4nF80Sjka0BpFJGALkk83RaEr3EEuCni5dx9eq1kuT2dL1jngeQ7AHwRG9opVaokYUyQJIno+z5QBWXJsTBY63McwDckCwBlsn8ZQxYSgB3+v/BruMPUHXOjUPf9qD2O++6Pm3woJa+U8QdoWUBjGXPA/Bm5pMUiYStAVZUYCGi4jVBxGnQn6MLONDUhap6N6qd3ah2dZK6sOdMB2oa3JDVQgCjcc5cB1A2B1glgJcE8CoKBGJpQX2bKrH7dDtqzndjf1YVBHDI2VFQAStzPk22AV5R9lyBJA18OhHAgfNe1Ljy5vubvPhEADwsAiAZAFLrsgUQhm4ep9fxuVV89kMv9jk7ydgrzPc1erC34RFVoB21BLBxCcwy3wgQDm8CEOHLIwW8oUqcvfYbKurcONjULcpfVdeBytNttPYd2HXsHg42tBsqUNyYxf2E+0c4vGYN8D8B0AHAyFQIlXUPaQN61813fHUTv4/M4L/nQTi+/AWVJ+8XAJgZ60raA+A+QMnD8+QZPj7VLgC45B98fRPux/9mH800DPme46MjtwuWwGiuAyTXZQsgnr023X88w4cnHtDm68LOI3fR0vlUGEmsrOlfPr+hAsWy3yJAItvl/h4PYOc3bbQMblTRuq/EJGEUl1XqkCokRTc2AzCa2wbgyzdKbZj2IY7+3A/H56344kKvMJFJSQJIkSRSWlENS5BEMslKFFUmI2N1dcUagG/ttZRehWA4ju+v/wrH4Rv48dYTjPlDIDZQAQgGlL2+X3J3gd2wBOBQsj+MxWKIx+PiKcZKXG4e29vbU1Q9Pbr6+vrg8XjMAS5eulLyddzS2opy/wq+BTgoCRlpZOGDAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e3b262e46d9d827a57313ca32e2c07c5ebb768c692044bde9be2e76dc770d58b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1790975029502,"unified_at":"2026-10-02T21:03:49.502Z","metadata":{"hashes":{"sha256":"e3b262e46d9d827a57313ca32e2c07c5ebb768c692044bde9be2e76dc770d58b","sha1":"29b0fa745c4b864fccd53dea9e3686d319a9dca9","md5":"673a2f9e511df048f54fd35b97726273","sha512":"b033e1897113cfa33ba894a73720f9e1dc55e13f460f42215c605bd603b256c27fd11cf62949eee2dd639fa2323da1f7f424904b800c08956de0ec98e470630f","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://www.colonywoodstock.com/profile/watch-jurassic-world-dominion-free-streaming-online-now/profile","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1654721046000,"last_seen":1663194791000,"last_multi_scan":1663194791000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":1},"sandbox_signatures":{"informative_count":8,"suspicious_count":2,"malicious_count":0,"total":10},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Found decrypted SSL traffic"}],"sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Tries to identify Internet Explorer version from registry","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-103","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.87.129:443\"\n \"151.101.1.91:443\"\n \"151.101.1.26:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9c8_IESQMMUTEX_0_519\"\n \"Local\\InternetShortcutMutex\"\n \"IsoScope_9c8_IE_EarlyTabStart_0xedc_Mutex\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2504\"\n \"IsoScope_9c8_IESQMMUTEX_0_331\"\n \"IsoScope_9c8_IESQMMUTEX_0_303\"\n \"IsoScope_9c8_IESQMMUTEX_0_519\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"Local\\ZonesCacheCounterMutex\"\n \"IsoScope_9c8_ConnHashTable<2504>_HashTable_Mutex\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2504\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"level":"informative","category":"Network Related","name":"Found decrypted SSL traffic","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.colonywoodstock.com/profile/watch-jurassic-world-dominion-free-streaming-online-now/profile\"- [Source: Input]\n Pattern match: \"https://www.colonywoodstock.com\"- [Source: Input]\n Pattern match: \"www.colonywoodstock.com\"- [Source: SSL_104.21.87.129]","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4817 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"level":"suspicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.87.129 on port 443 is sent without HTTP header\n TCP traffic to 151.101.1.91 on port 443 is sent without HTTP header\n TCP traffic to 151.101.1.26 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":120,"dropped_files_count":0,"extracted_files_count":28,"files_written_count":41,"files_deleted_count":0,"registry_keys_created_count":20,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":20,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"sandbox_reports":[{"id":"62a10a1547512e56165ed83a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"e3b262e46d9d827a57313ca32e2c07c5ebb768c692044bde9be2e76dc770d58b.url","analysis_start_time":"2022-06-08T20:44:07+00:00","indicators_count":{"informative":8,"suspicious":3,"malicious":0},"tags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.87.129","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"address":"151.101.1.91","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"address":"151.101.1.26","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}],"processes":[{"pid":2332,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\System32\\ieframe.dll\",OpenURL C:\\e3b262e46d9d827a57313ca32e2c07c5ebb768c692044bde9be2e76dc770d58b.url","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002332","icon":"$2b"},{"pid":2504,"ppid":2332,"name":"iexplore.exe","command_line":"https://www.colonywoodstock.com/profile/watch-jurassic-world-dominion-free-streaming-online-now/profile","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002332","uid":"00000000-00002504"},{"pid":3328,"ppid":2504,"name":"iexplore.exe","command_line":"SCODEF:2504 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002504","uid":"00000000-00003328"}],"all_imported_dlls":["netutils.dll","oleaccrc.dll","uxtheme.dll","mscoree.dll","schannel.dll","lpk.dll","nsi.dll","IPHLPAPI.DLL","shell32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","duser.dll","propsys.dll","wshqos.dll","d3d11.dll","cryptnet.dll","setupapi.dll","wintrust.dll","webio.dll","ssv.dll","URLREDIR.DLL","user32.dll","ws2_32.dll","cfgmgr32.dll","bcrypt.dll","advapi32.dll","api-ms-win-core-synch-l1-2-0.dll","fltLib.dll","msasn1.dll","nlaapi.dll","powrprof.dll","deploy.dll","iertutil.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","imm32.dll","normaliz.dll","rpcss.dll","mswsock.dll","cryptsp.dll","credssp.dll","msvcr100.dll","RpcRtRemote.dll","srvcli.dll","dnsapi.dll","dxgi.dll","kernel32.dll","version.dll","apphelp.dll","dhcpcsvc.dll","devobj.dll","winhttp.dll","WSHTCPIP.DLL","msvcr90.dll","dhcpcsvc6.dll","Wldap32.dll","oleaut32.dll","DWrite.dll","netapi32.dll","ncrypt.dll","d3d10warp.dll","wininet.dll","userenv.dll","mlang.dll","KernelBase.dll","ieproxy.dll","msimtf.dll","msctf.dll","wkscli.dll","sspicli.dll","crypt32.dll","ntmarta.dll","rpcrt4.dll","comctl32.dll","clbcatq.dll","jp2ssv.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wship6.dll","WindowsCodecs.dll","mscoreei.dll","urlmon.dll","oleacc.dll","dui70.dll","cryptbase.dll","jscript9.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msimg32.dll","ole32.dll","FWPUCLNT.DLL","sechost.dll","IEShims.dll","comdlg32.dll","sqmapi.dll","winnsi.dll","bcryptprimitives.dll","gpapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","dwmapi.dll","rsaenh.dll","sxs.dll","secur32.dll","ExplorerFrame.dll","d2d1.dll","MSOHEV.DLL","imagehlp.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","netprofm.dll","rasadhlp.dll","gdi32.dll","profapi.dll","npmproxy.dll","api-ms-win-downlevel-user32-l1-1-0.dll","usp10.dll","mscorwks.dll","api-ms-win-downlevel-version-l1-1-0.dll","shlwapi.dll","ieframe.dll","SensApi.dll","mshtml.dll","msvcrt.dll","ieui.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"favicon_3_.ico","sha256":"5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"favicon_2_.ico","sha256":"5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"0AJB539O.txt","sha256":"128f5a1175b1c6c6ca5fe041b5f21f148c5defd766d3ea7bbe7ab5c72d045afd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"6EPY03X3.txt","sha256":"e5a161ed3f9491b2c3ed9a0a1b27820bcaf655c564636e2243737567d5169d39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"L5VWT21L.txt","sha256":"396f8be4709983a9772d21a9437c867cb6a9bcd3b551fa91d65197f5fbab9859","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"MV3MXU7N.txt","sha256":"d9a4d0e18eddea6e7a65b1dad8fafe2801773c6f54ffa59abba7e1dd24fafbeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"X7GJXYDD.txt","sha256":"b49256220d2d8f4c3d68f1a42c70244d9063e8907a9433c250f75ced4b230554","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"en-US.4","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sha256":"7c868be2b21eb3fb7c939b378f60dc4ad4a5d2557992e27f9af720515a41f599","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"2f5435a6e6010e066d6b2087077ad5e141c6fd1df09a029fca8fb2c7e9762ae5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27","sha256":"4d08c29d83f89d3ad281709dab007a70de7c142d8e9fa93b5d469ab53c8fc1fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sha256":"a997454f100c680171310a62f6dcf4447ea4fcc6c8e9fffd8adc7f0368d91a3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868","sha256":"4a34137e04fcef121a2430894fd2ce68a34067b124c85819de64519b75cf478b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"B039FEA45CB4CC4BBACFC013C7C55604_D2A36BFFF0D303240FC776EF3238CCA0","sha256":"eefb6219c776bfa6ab9a0855c89811e486e88e92aa8c3c1f091f80434fcf41a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"~DF0174457AD8236D57.TMP","sha256":"947511d434910c0774588c19b57a41c1146696255b59321dcd101a286e085e30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"~DF4A8CB4A9F6CB9504.TMP","sha256":"8441ac35f840abc0a84509fac59d459b9f73579d8431a18c327cd4dbd7d6ccc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"~DF62873C6371F67390.TMP","sha256":"76f24292791bc2411ced593582f6ee7c0c6587db8f48dbf1f5f9650a465a69ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"~DF79CF2983085F7DBE.TMP","sha256":"836b38222104865d490949a67f69711d26a0aa2c09247d290b074f83a7726ee2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"profile_1_.htm","sha256":"56b8347cbfe2f978aade571be1a3c99d6676759aead505b2ccc86d622a8beafd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"search_2_.json","sha256":"19170bd75edc0b5183a2f9fcc3001d9d222deff61e5915ad1127b65ab581a2a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"_29256221-E75B-11EC-9F92-080027042769_.dat","sha256":"a3fa0dfaae7ffe15225be3aa753cb6af6bca789a99176991423be168545662a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico","sha256":"5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"_339D3546-E75B-11EC-9F92-080027042769_.dat","sha256":"f50c60611fab00878dadba973291ad0fa4fc8a6ef1183e1cd4afe422abfa7ae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"RecoveryStore._88B090C0-D917-11E7-B67B-080027A49DD6_.dat","sha256":"bd5cba1801f252f10c806b53cba853057c0259762c21c5f54b519110ac6241b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"RecoveryStore._2925621F-E75B-11EC-9F92-080027042769_.dat","sha256":"b158760afd4e0634f8d4103a10588af7833ea856c531f6a893500c5e9599f1e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"polyfill.min_1_.js","sha256":"93d457284753fa1991dc8beb4941b68559cd54604ffa21979f3357d15ff3d2fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"urlref_httpswww.colonywoodstock.comprofilewatch-jurassic-world-dominion-free-streaming-online-nowprofile","sha256":"29666e2e53a6baa62148ddb232c9f3fc23d8d6e666f75daec5c562793b543312","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{2925621F-E75B-11EC-9F92-080027042769}.dat","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%TEMP%\\~DF79CF2983085F7DBE.TMP","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{29256221-E75B-11EC-9F92-080027042769}.dat","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%TEMP%\\~DF4A8CB4A9F6CB9504.TMP","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\profile[1].htm","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%TEMP%\\~DF62873C6371F67390.TMP","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X7GJXYDD.txt","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L5VWT21L.txt","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.4","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\search[1].json","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B039FEA45CB4CC4BBACFC013C7C55604_D2A36BFFF0D303240FC776EF3238CCA0","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{339D3546-E75B-11EC-9F92-080027042769}.dat","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\P3P\\HISTORY\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9c8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"Local\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"IsoScope_9c8_IE_EarlyTabStart_0xedc_Mutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2504","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"IsoScope_9c8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"IsoScope_9c8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"IsoScope_9c8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"IsoScope_9c8_ConnHashTable<2504>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2504","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9c8_IE_EarlyTabStart_0xedc_Mutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9c8_ConnHashTable<2504>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9c8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9c8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]},{"name":"IsoScope_9c8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"62a10a1547512e56165ed83a"}]}]}},"report_ids":{"sandbox_job_ids":["62a10a1547512e56165ed83a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample e3b262e46d9d… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample e3b262e46d9d…. Threat score 0/100. 0/1 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e3b262e46d9d827a57313ca32e2c07c5ebb768c692044bde9be2e76dc770d58b"}],["$","meta","4",{"property":"og:title","content":"Sample e3b262e46d9d… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample e3b262e46d9d…. Threat score 0/100. 0/1 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e3b262e46d9d827a57313ca32e2c07c5ebb768c692044bde9be2e76dc770d58b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample e3b262e46d9d… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample e3b262e46d9d…. Threat score 0/100. 0/1 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]