26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 3f5bbdb78b0a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3f5bbdb78b0a…. Malware family: Trojan.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 13 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3f5bbdb78b0af94f95762ee128ea405cc237786265235f9dcdc5e2a7ebdbf885","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","3f5bbdb78b0af94f95762ee128ea405cc237786265235f9dcdc5e2a7ebdbf885"],"about":{"@type":"SoftwareApplication","name":"3f5bbdb78b0af94f95762ee128ea405cc237786265235f9dcdc5e2a7ebdbf885.bin","applicationCategory":["peexe","executable"],"identifier":"3f5bbdb78b0af94f95762ee128ea405cc237786265235f9dcdc5e2a7ebdbf885","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5f2,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003536.00000000.156657.02610000.00000004.mdmp, 00000000-00003536.00000000.156657.06F80000.00000004.mdmp, 00000000-00003536.00000001.157378.02610000.00000004.mdmp, 00000000-00003536.00000001.157378.06F80000.00000004.mdmp, 00000000-00003536.00000001.157378.084B0000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003536.00000000.156657.02610000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00003536.00000000.156657.02610000.00000004.mdmp, 00000000-00003536.00000001.157378.02610000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00003536.00000000.156657.02610000.00000004.mdmp, 00000000-00003536.00000001.157378.02610000.00000004.mdmp") Found string "policy.3.0.System.Management.Automation.resources" (Source: "00000000-00003536.00000001.157378.06C5A000.00000004.mdmp, 00000000-00003536.00000001.157378.06E7B000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00003536.00000001.157378.06C5A000.00000004.mdmp, 00000000-00003536.00000001.157378.06E7B000.00000004.mdmp") Found string "System.Management.Automationn" (Source: "00000000-00003536.00000001.157378.06FF0000.00000004.mdmp")28:T537,")qr.me" Heuristic match: "pathext=.cg"44:T86bb,Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00001280.00000000.166801.04400000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003536.00000000.156657.02610000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003536.00000000.156657.02610000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003536.00000000.156657.02610000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003536.00000000.156657.02610000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003536.00000000.156657.02610000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfgeotrust" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0r0m01.3.6.1.5.5.7.1.12" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003536.00000000.156657.026F3000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003536.00000000.156657.02A10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003536.00000000.156657.02A10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003536.00000000.156657.02A10000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lus1" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lk)q@lfk)q@lf4d(q@d(qld(qxd(qdd(qpd(q" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>k)q@8g(qxmm)l*ark)q" - Source: "00000000-00003536.00000000.156657.06F80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003536.00000001.157378.0268C000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003536.00000001.157378.0268C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003536.00000001.157378.0268C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003536.00000001.157378.0268C000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003536.00000001.157378.0268C000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfgeotrust" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ysystem.configurationdigicert" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0r0m01.3.6.1.5.5.7.1.12" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003536.00000001.157378.026F3000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lus1" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00003536.00000001.157378.06F80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003536.00000001.157378.06FF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0?k" - Source: "00000000-00003536.00000001.157378.06FF0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003536.00000001.157378.06FF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0at-kt2017092966z0washington1redmonmicrosoft" - Source: "00000000-00003536.00000001.157378.0703B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/^ccrooceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@stcn$vkt7" - Source: "00000000-00003536.00000001.157378.0703B000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00003536.00000001.157378.0703B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!yttu" - Source: "00000000-00003536.00000001.157378.084B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt00k'qlk'q(d(q4d(q@d(qld(qxd(qdd(qpd(q" - Source: "00000000-00003536.00000001.157378.0850A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00003536.00000001.157378.0850A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003536.00000001.157378.08522000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" - Source: "00000000-00003536.00000001.157378.6FDA1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003924.00000000.156384.03670000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00003924.00000000.156384.05C08000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%285.9" - Source: "00000000-00003924.00000000.156384.05C08000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00003924.00000000.156384.05C08000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00003924.00000000.156384.05C08000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00003924.00000000.156384.05C08000.00000004.mdmp") Found URL "https://salator.esu6666666666666666666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\tls13" - Source: "00000000-00003924.00000000.156384.05C32000.00000004.mdmp") Found URL "http://i.pki.goog/wr2.crtgoogle" - Source: "00000000-00003924.00000000.156384.05CA6000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crlgoogle" - Source: "00000000-00003924.00000000.156384.05CA6000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr1http://pki.goog/gsr1/gsr1.crt2.5.29.152.5.29.192.5.29.14c%o9-*hgxbi" - Source: "00000000-00003924.00000000.156384.05CA6000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003924.00000001.158304.03670000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003924.00000002.160222.03670000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ysr1hlz%2ba%2byaqmbjn5kbyoxtlo3dvfrcthr%2fc3ahxzefjwlu0hdylnvc%2bedvmjgp7n%2fbgp7w0lwjj28ru0uvwxu8nwsujrm75njlop83fhx0xkwki4qgbwnugckb" - Source: "00000000-00003924.00000002.160222.08700000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=tcpllny0jgze1d616egaitqk9ouzd1ieto9py31v5isufs3xzif%2fih4gvzk3dst9juuahfqosyz9vdmyjbmejesn8%2b0jjhrfz3mh8ezxnneehczktwlunl4rsdm9" - Source: "00000000-00003924.00000002.160222.08700000.00000004.mdmp") Found URL "http://schvmicrosoft.com/wqs/2004/02/mit/t\" - Source: "00000000-00004168.00000001.156068.03E40000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/kpk0%http://i.pki.goog/we1.crt0" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://c.pki.goog/we1/_dxv1mtmojc.crl0\ca)20260411041347z0s0q0i0" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o)" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%285.9" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/ogoogle" - Source: "00000000-00004168.00000001.156068.06880000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00004788.00000000.166799.03C00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005336.00000000.156773.00CB0000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm*vpp)sa3d27cfa-1e7a-4ff8-8004-2be13417b6b1e11f5196-4c6b-b8f9-0e24-e05f32ba964c(c)" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?jp1%0" - Source: "00000000-00005336.00000000.156773.06080000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," (Indicator: "password"; Source: "00000000-00003536.00000001.157378.0268C000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00003536.00000001.157378.086C0000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00003536.00000001.157378.086C0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00003536.00000001.157378.08700000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00003536.00000001.157378.08700000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00003536.00000001.157378.08720000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00003536.00000001.157378.08760000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00003536.00000001.157378.087A0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00003536.00000001.157378.087A0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00003536.00000001.157378.087A0000.00000004.mdmp")48:T552,Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00003536.00000001.157378.08556000.00000004.mdmp, 00000000-00003536.00000001.157378.085F1000.00000004.mdmp") Found string "DisableBlockAtFirstSeen" (Indicator: "disableblockatfirstseen"; Source: "00000000-00003536.00000001.157378.08556000.00000004.mdmp, 00000000-00003536.00000001.157378.085F1000.00000004.mdmp") Found string "DisableIntrusionPreventionSystem" (Indicator: "disableintrusionpreventionsystem"; Source: "00000000-00003536.00000001.157378.08556000.00000004.mdmp, 00000000-00003536.00000001.157378.085F1000.00000004.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00003536.00000001.157378.08556000.00000004.mdmp, 00000000-00003536.00000001.157378.085F1000.00000004.mdmp, 00000000-00003536.00000001.157378.6FDA1000.00000020.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00003536.00000001.157378.08556000.00000004.mdmp, 00000000-00003536.00000001.157378.085F1000.00000004.mdmp, 00000000-00003536.00000001.157378.6FDA1000.00000020.mdmp") Found string "DisableScriptScanning" (Indicator: "disablescriptscanning"; Source: "00000000-00003536.00000001.157378.08556000.00000004.mdmp, 00000000-00003536.00000001.157378.085F1000.00000004.mdmp")49:T802," www.upx.sourceforge.net\"\n \"mitmdump.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69dd5740da7ef95db50fe3d2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"