34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 77:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 5fcc6ae19268… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5fcc6ae19268…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 17 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5fcc6ae192686e696d618901f374ecf8aecc5ae5b591973c8dba2f877f128cf7","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","5fcc6ae192686e696d618901f374ecf8aecc5ae5b591973c8dba2f877f128cf7"],"about":{"@type":"SoftwareApplication","name":"5fcc6ae192686e696d618901f374ecf8aecc5ae5b591973c8dba2f877f128cf7.bin","applicationCategory":["peexe","executable"],"identifier":"5fcc6ae192686e696d618901f374ecf8aecc5ae5b591973c8dba2f877f128cf7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":17,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T653,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003624.00000000.221650.00E50000.00000004.mdmp, 00000000-00003624.00000001.222678.00E73000.00000004.mdmp, 00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found string "ile:///C:/WINDOWS/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.EXE" (Source: "00000000-00003624.00000000.221650.00E50000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00003624.00000000.221650.00E50000.00000004.mdmp, 00000000-00003624.00000001.222678.00E73000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00003624.00000000.221650.00E50000.00000004.mdmp, 00000000-00003624.00000001.222678.00E73000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\" (Source: "00000000-00003624.00000000.221650.00F33000.00000004.mdmp") Found string "System.Management.Automation.pdb" (Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found string "??\C:\WINDOWS\dll\System.Management.Automation.pdb" (Source: "00000000-00003624.00000001.222678.08BDC000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00003624.00000001.222678.08C3D000.00000004.mdmp")37:Tf70,file/memory contains long string with (Indicator: "add-mppreference"; File: "AMSI") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp")38:T5cd,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002868.00000000.222619.03312000.00000004.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00002868.00000001.222870.03312000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003624.00000001.222678.01031000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003624.00000001.222678.01031000.00000002.mdmp")39:T77b,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "5fcc6ae192686e696d618901f374ecf8aecc5ae5b591973c8dba2f877f128cf7.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002332.00000000.220991.05D80000.00000004.mdmp, 00000000-00002332.00000001.221041.05D80000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp")3a:T13a8,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp")3b:T842,"" (Indicator: "enumchildwindows"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002868.00000000.222619.03300000.00000004.mdmp, 00000000-00002868.00000001.222870.03300000.00000004.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00002868.00000000.222619.03312000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00002868.00000000.222619.03312000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002868.00000000.222619.03312000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00002868.00000000.222619.03312000.00000004.mdmp")44:T2c82," HTTP/1.1 302 Found Date: Sat 25 Apr 2026 16:00:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-961e5d85368405d88ceefbcddb36edb1; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=FQ3eTuXEWbvP8xAyJm4m8e6upeNwz8Q7A3cXMI2e0YE-1777132836.8547192-1.0.1.1-_fmwQEnxmvl48.WA4BLH11ZnigsAJTH8siORsiHX3iE; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f1e8fc65e82a666-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-SS6eFgfga2KuMO1gY7qWLA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-42-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 1 ratelimit-remaining: 499 ratelimit-reset: 1777132860 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f1e8fc65e82a666-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f1e8fc65e82a666-SJC x-runtime: 0.047156 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Sat 25 Apr 2026 16:00:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-cNlhmyru1PxZbQDF7D7pHd' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f1e8fc79fcaa666" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1kFUPF9xiYSvjJdXmPvw3vJbjiiWz3gzCzVPQk349Srlg2xCN8kU9zmxdkuVgppiNFel80z9gnZ4BMxOPtxzI9xWyXKU5o6%2Fad1zBSq4lz8ULTj%2FVI5F6k%2B8HJw%3D"}]} CF-RAY: 9f1e8fc79fcaa666-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Sat 25 Apr 2026 16:00:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-d95abc1f19d255156366e34843a70357; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=3H6mBvPflPK5BmaVDCzAkllh1D2pkAb4X4BqkhrI6fY-1777132837.2722185-1.0.1.1-X3TgV9u1uCYUOQ9khF6PqlBX5j15THn7Cv8LWIN8acc; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f1e8fc8fff491f0-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-EYNIUeH+DSMpj5MMSWvUXw=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-60-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 2 ratelimit-remaining: 498 ratelimit-reset: 1777132860 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f1e8fc8fff491f0-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f1e8fc8fff491f0-SJC x-runtime: 0.046465 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Sat 25 Apr 2026 16:00:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-AFjvdnXzkIo7oIieUVP4fL' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f1e8fc9e85d91f0" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=9ZTBG%2FB4zKMPWNtQZPdO%2FicU7ZzXlKcEkhJ9wKmFYtmZkC%2BrvD8zVTWbSERWbhxz8rpF1ay1UJXRAdWrNeOYQI3Q8OA7LlyjTWDlxNT2fzCfsys4YaFi2whvcb0%3D"}]} CF-RAY: 9f1e8fc9e85d91f0-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Sat 25 Apr 2026 16:00:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-081c00cfd8ce0ada6d926b5dfa650ffd; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=Tz.ACdHNIyQzFAQ1HiEsYdoxRBJpAn9xDwgmaPcOb_I-1777132837.468936-1.0.1.1-UY6dborhTzSCpH.bQzBfqTLFvInJYQhTXOiyjh59QSQ; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f1e8fca2d6a67d7-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-oNJsR4PHEV0T84qp7ijjHQ=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-07-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 3 ratelimit-remaining: 497 ratelimit-reset: 1777132860 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f1e8fca2d6a67d7-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f1e8fca2d6a67d7-SJC x-runtime: 0.043748 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Sat 25 Apr 2026 16:00:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-dBDAaBbDcunv785HJv5nm7' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f1e8fcb2dd967d7" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=LVaOjk3CTjG3Rs7T1ODGx4lgg1hdAIEMiwZpgshHqOEvMDHv36PlpgOjG47cpVUHtCGFoREkYaJhNC2lVzQjZlLGRs6WdOJ9NMm4M9jHfxZdA04AuOmsFcDKb7Q%3D"}]} CF-RAY: 9f1e8fcb2dd967d7-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Sat 25 Apr 2026 16:00:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-cee76d28cdbfaccda14b2246ccbbceb6; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=Hna6JWKcxxy8N0kKzt6Rg_vECWms8mn3MiJj7dDSeck-1777132837.668991-1.0.1.1-y.10J7_Zul95T95gDbik9B0YmheMVycyPDqMsZNpsYU; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f1e8fcb6b441664-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-ubmY4xHrkEgJ24MHu+sN+Q=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-10-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 4 ratelimit-remaining: 496 ratelimit-reset: 1777132860 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f1e8fcb6b441664-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f1e8fcb6b441664-SJC x-runtime: 0.041075 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Sat 25 Apr 2026 16:00:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-HnxcSD1LMoNAIqmgks5jLk' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f1e8fcc6b981664" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=7sNvhp92xJvtxFN3Lov3QZ4bEsadjR23wu8YPX68Va69yY7LM%2B3KkQQ0wOBEXA5oV0bOuaKAQMizj%2F30pHjYul1DtQFsAA0Vnuzbo%2BTJKERhIAoDYbUK49zT9VY%3D"}]} CF-RAY: 9f1e8fcc6b981664-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Sat 25 Apr 2026 16:00:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-5c21c374f645186d02b136adc76b3f90; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=1rBVXwdFShNJAOXJTFSbPASVY2wLkuGyvXFIXnH1c_c-1777132837.869837-1.0.1.1-BdQ.KTCOvQurUIlYjaSWJmC8s5BvagmUExnLuOlZWLY; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f1e8fccad9b6e82-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-TlkPc3Vg5G80DFMXyqGV4w=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-40-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 5 ratelimit-remaining: 495 ratelimit-reset: 1777132860 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f1e8fccad9b6e82-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f1e8fccad9b6e82-SJC x-runtime: 0.041765 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Sat 25 Apr 2026 16:00:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-NCr9iJFi9JucSkJbnjjnuU' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f1e8fcdaf646e82" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wexf6y%2F8fa0zck8kKgmq7ghWNLVeNI67cCBdQilYQBlj57NkdJSNnAPGtKleHJ5zeLp3iUGta9Ni5Jp59sqNA%2B0qta%2Fg53t8oU8ZVu49jqM230xwIo5nfxrrqEc%3D"}]} CF-RAY: 9f1e8fcdaf646e82-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C.......51:T4230,"" - Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp") Found URL "https://salator.es/sa1at/https://salator.es/sa1at/*map[string]interface" - Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp") Found URL "https://salator.es/sa1at/https://salator.es/sa1at/" - Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/i9e0%http://i.pki.goog/we1.crt0" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://c.pki.goog/we1/jkijdkdqfbc.crl0-(dy-;w9zv!)hwqx2@," - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "https://dns.google/resolve?name=salator.escommonprogramfiles=c:\program" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/i9ehttp://i.pki.goog/we1.crtvj" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crlgoogle" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmqb36uuuugoogle" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://o.pki.goog/wr2google" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crtglobalsign" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0digicert" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://c.pki.goog/we1/jkijdkdqfbc.crl!lgwg4229" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o&=lta186_/?jr8jysx$ila0iirdjabpwj;vq,+d2q>" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "https://salator.es/sa1at/https://salator.es/sa1at/*map[string]interface" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "https://salator.es/sa1at/https://salator.es/sa1at/" - Source: "00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002868.00000000.222619.03300000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002868.00000001.222870.03300000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003624.00000000.221650.00E50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003624.00000000.221650.00E50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003624.00000000.221650.00F33000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?d" - Source: "00000000-00003624.00000000.221650.00F33000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcthawte," - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00p1+0)" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0frtqb=?" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003624.00000000.221650.07520000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003624.00000001.222678.00E73000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003624.00000001.222678.00E73000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l0," - Source: "00000000-00003624.00000001.222678.00F33000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003624.00000001.222678.00F33000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?o8mlo6mlo4mlo2mlo0mlo.mlo,mlo*mlo(mlo&ml" - Source: "00000000-00003624.00000001.222678.00F33000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003624.00000001.222678.00F33000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00003624.00000001.222678.00F33000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;;" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l011_upxtu" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^" - Source: "00000000-00003624.00000001.222678.075D6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003624.00000001.222678.075D6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00003624.00000001.222678.075D6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!u" - Source: "00000000-00003624.00000001.222678.08B00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00003624.00000001.222678.08B00000.00000004.mdmp") Found URL "https://gitlab.com/users/sign_in" - Source: "00000000-00003624.00000001.222678.08BDC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microo" - Source: "00000000-00003624.00000001.222678.08C3D000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003624.00000001.222678.08C73000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003624.00000001.222678.08C73000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003624.00000001.222678.08C73000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003624.00000001.222678.08C73000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003624.00000001.222678.08C73000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003624.00000001.222678.08C73000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003624.00000001.222678.6EFA1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004056.00000000.222619.00E10000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004056.00000001.222842.00E10000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00004056.00000001.222842.06000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00004056.00000001.222842.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00004056.00000001.222842.06000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00004056.00000001.222842.06000000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00004056.00000001.222842.06000000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00004056.00000001.222842.06000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00004056.00000001.222842.06000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00004056.00000001.222842.06000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004056.00000001.222842.06000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00005456.00000000.228346.03C00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005500.00000000.222357.03690000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm*vppa3d27cfa-1e7a-4ff8-8004-2be13417b6b122719d5d-2f0c-eea9-da11-8f68b0135d2f(c)" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?x" - Source: "00000000-00005500.00000000.222357.05800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00005500.00000000.222357.05980000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00005500.00000000.222357.05980000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00005500.00000000.222357.05980000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00005500.00000000.222357.05980000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00005500.00000000.222357.05980000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00005684.00000000.228277.04400000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006616.00000000.221353.01010000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00006616.00000000.221353.06406000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/75r4zya3va0.crl0=q2%(fdj" - Source: "00000000-00006616.00000000.221353.06406000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00006616.00000000.221353.0644A000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00006616.00000000.221353.0644A000.00000004.mdmp") Found URL "http://i.pki.goog/wr2.crtgoogle" - Source: "00000000-00006616.00000000.221353.064A4000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crlgoogle" - Source: "00000000-00006616.00000000.221353.064A4000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr1http://pki.goog/gsr1/gsr1.crtats52.5.29.152.5.29.192.5.29.14v@^]c%oerkqp2w?wzh" - Source: "00000000-00006616.00000000.221353.064A4000.00000004.mdmp") Found URL "https://salator.es/sa1at/https://salator.es/sa1at/sat," - Source: "00000000-00006616.00000000.221353.064A4000.00000004.mdmp")64:T79e,Found string "B+ncalrpc:[OLE8444B2BE98EB2A5446E8F7B92ADF]" (Indicator: "ncalrpc"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found string "+ncalrpc:[OLE06D80FE6C49E8FE8D01538E29097]" (Indicator: "ncalrpc"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp") Found string "+ncalrpc:[OLE8444B2BE98EB2A5446E8F7B92ADF]" (Indicator: "ncalrpc"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found string "B+ncalrpc:[OLEEFB2265F2AFA446C41B89CF6B2ED]" (Indicator: "ncalrpc"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found string "+ncalrpc:[OLE97313828DD12C75BA9FD36124114]" (Indicator: "ncalrpc"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found string "+ncalrpc:[OLE95152FE8235976D279B51DEB5377]" (Indicator: "ncalrpc"; Source: "00000000-00003624.00000000.221650.00E50000.00000004.mdmp, 00000000-00003624.00000001.222678.00E73000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003624.00000001.222678.08B00000.00000004.mdmp") Found string "+ncalrpc:[OLEEFB2265F2AFA446C41B89CF6B2ED]" (Indicator: "ncalrpc"; Source: "00000000-00003624.00000001.222678.08B00000.00000004.mdmp") Found string "B+ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00003624.00000001.222678.08C3D000.00000004.mdmp")65:T1586,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002868.00000000.222619.03300000.00000004.mdmp, 00000000-00002868.00000001.222870.03300000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002868.00000000.222619.03300000.00000004.mdmp, 00000000-00002868.00000001.222870.03300000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002868.00000000.222619.03300000.00000004.mdmp, 00000000-00002868.00000001.222870.03300000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002868.00000000.222619.03300000.00000004.mdmp, 00000000-00002868.00000001.222870.03300000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002868.00000000.222619.03300000.00000004.mdmp, 00000000-00002868.00000001.222870.03300000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002868.00000000.222619.03300000.00000004.mdmp, 00000000-00002868.00000001.222870.03300000.00000004.mdmp")66:T618,Found reference to API "10744333127,7832,3024,,RtlGetVersion,NTDLL.dll,"00:57:43.218",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00003624.00000000.221650.00F33000.00000004.mdmp") Found reference to API "10865962986,5728,3025,,RtlGetNtProductType,NTDLL.dll,"00:57:43.265",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00003624.00000000.221650.00F33000.00000004.mdmp") Found reference to API "10743998077,7832,3025,,RtlGetNtProductType,NTDLL.dll,"00:57:43.218",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00003624.00000000.221650.00F33000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp") Found reference to API "43662207452,1108,3025,,RtlGetNtProductType,NTDLL.dll,"00:57:56.921",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00003624.00000001.222678.08C1B000.00000004.mdmp") Found reference to API "43662302954,1108,3024,,RtlGetVersion,NTDLL.dll,"00:57:56.921",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00003624.00000001.222678.08C1B000.00000004.mdmp") Found reference to API "42986076640,1108,3025,,RtlGetNtProductType,NTDLL.dll,"00:57:56.656",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00003624.00000001.222678.08C1B000.00000004.mdmp") Found reference to API "43407473113,1108,3025,,RtlGetNtProductType,NTDLL.dll,"00:57:56.812",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00003624.00000001.222678.08C1B000.00000004.mdmp")67:T56c,Found registry query API: "RegOpenKeyExW" in "00000000-00001296.00000001.222766.04800000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001296.00000001.222766.04800000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001884.00000000.228346.04400000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001884.00000000.228346.04400000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002868.00000001.222870.05C00000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002868.00000001.222870.05C00000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003624.00000001.222678.01031000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00003624.00000001.222678.01031000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003624.00000001.222678.01031000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00003624.00000001.222678.01031000.00000002.mdmp"68:T12b0,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003624.00000000.221650.00F33000.00000004.mdmp, 00000000-00003624.00000001.222678.00F33000.00000004.mdmp, 00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000000.221650.01021000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003624.00000001.222678.00E73000.00000004.mdmp, 00000000-00003624.00000001.222678.00F33000.00000004.mdmp, 00000000-00003624.00000001.222678.07520000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003624.00000001.222678.00F33000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp, 00000000-00003624.00000001.222678.087D0000.00000004.mdmp, 00000000-00003624.00000001.222678.08920000.00000004.mdmp, 00000000-00003624.00000001.222678.08D20000.00000004.mdmp, 00000000-00003624.00000001.222678.08D30000.00000004.mdmp, 00000000-00003624.00000001.222678.08D80000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp, 00000000-00003624.00000001.222678.087D0000.00000004.mdmp, 00000000-00003624.00000001.222678.08920000.00000004.mdmp, 00000000-00003624.00000001.222678.08D20000.00000004.mdmp, 00000000-00003624.00000001.222678.08D30000.00000004.mdmp, 00000000-00003624.00000001.222678.08D80000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00003624.00000001.222678.08330000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00003624.00000001.222678.087D0000.00000004.mdmp")69:T666,Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found reference to API "9922567483,7608,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:57:42.875",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003624.00000000.221650.00F33000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp")6a:T483,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "5fcc6ae192686e696d618901f374ecf8aecc5ae5b591973c8dba2f877f128cf7.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002332.00000000.220991.05D80000.00000004.mdmp, 00000000-00002332.00000001.221041.05D80000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp")6b:T8f2,file/memory contains long string with (Indicator: "GetTempPath"; File: "AMSI") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference to API "$tempPath = [System.IO.Path]::GetTempPath()" (Indicator: "GetTempPath"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference to API "$tempPath = [System.IO.Path]::GetTempPath()" (Indicator: "GetTempPath"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference to API "$tempPath = [System.IO.Path]::GetTempPath()" (Indicator: "GetTempPath"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference to API "$tempPath = [System.IO.Path]::GetTempPath()" (Indicator: "GetTempPath"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found reference to API "$tempPath = [System.IO.Path]::GetTempPath()" (Indicator: "GetTempPath"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp")6c:T437,file/memory contains long string with (Indicator: "Get-Command"; File: "AMSI") Found string "if (Get-Command Add-MpPreference -ErrorAction SilentlyContinue) {" (Indicator: "Get-Command"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found string "if (Get-Command Add-MpPreference -ErrorAction SilentlyContinue) {" (Indicator: "Get-Command"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found string "if (Get-Command Add-MpPreference -ErrorAction SilentlyContinue) {" (Indicator: "Get-Command"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found string "if (Get-Command Add-MpPreference -ErrorAction SilentlyContinue) {" (Indicator: "Get-Command"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found string "if (Get-Command Add-MpPreference -ErrorAction SilentlyContinue) {" (Indicator: "Get-Command"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp")6d:T66f,Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp") Found reference to API "38692619995,7276,3147,,GetComputerNameW,kernel32.dll,"00:57:54.859",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00003624.00000001.222678.08C1B000.00000004.mdmp") Found reference to API "42805803891,1108,3147,,GetComputerNameW,kernel32.dll,"00:57:56.578",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00003624.00000001.222678.08C1B000.00000004.mdmp") Found reference to API "48501986664,5728,3147,,GetComputerNameW,kernel32.dll,"00:57:58.937",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00003624.00000001.222678.08C1B000.00000004.mdmp") Found reference to API "37695306138,4192,3147,,GetComputerNameW,kernel32.dll,"00:57:54.437",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00003624.00000001.222678.08C1B000.00000004.mdmp") Found reference to API "38529113252,1108,3147,,GetComputerNameW,kernel32.dll,"00:57:54.796",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00003624.00000001.222678.08C1B000.00000004.mdmp")6e:T432,Found string "lect TotalPhysicalMemory from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found string "elect Name from Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found string "select Name from Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found string "select Name from Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp")6f:T62c,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001296.00000001.222766.03EA0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files (x86)\Reference Assemblies\ctfmon.exe" (Indicator: "\Device\"; Source: "00000000-00001884.00000000.228346.00B20000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001884.00000000.228346.00B20000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found string "\Device\HarddiskVolume2\5fcc6ae192686e696d618901f374ecf8aecc5ae5b591973c8dba2f877f128cf7.bin.exe" (Indicator: "\Device\"; Source: "00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003624.00000000.221650.00E50000.00000004.mdmp, 00000000-00003624.00000001.222678.00E50000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003624.00000000.221650.00E50000.00000004.mdmp, 00000000-00003624.00000001.222678.00E73000.00000004.mdmp")70:T45c,Found string "Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0" (Indicator: "Set-ItemProperty"; File: "AMSI") Found string "Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0" (Indicator: "Set-ItemProperty"; Source: "00000000-00001296.00000001.222766.04800000.00000004.mdmp") Found string "Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0" (Indicator: "Set-ItemProperty"; Source: "00000000-00001884.00000000.228346.04400000.00000004.mdmp") Found string "Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0" (Indicator: "Set-ItemProperty"; Source: "00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp") Found string "Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0" (Indicator: "Set-ItemProperty"; Source: "00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp") Found string "Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0" (Indicator: "Set-ItemProperty"; Source: "00000000-00002868.00000001.222870.05C00000.00000004.mdmp")71:T988,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002164.00000000.221763.03650000.00000004.mdmp, 00000000-00002164.00000001.221773.03650000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002868.00000000.222619.03300000.00000004.mdmp, 00000000-00002868.00000001.222870.03300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003624.00000000.221650.00E50000.00000004.mdmp, 00000000-00003624.00000000.221650.07520000.00000004.mdmp, 00000000-00003624.00000001.222678.07520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00002868.00000001.222870.03312000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003624.00000000.221650.00E50000.00000004.mdmp\n 00000000-00003624.00000000.221650.07520000.00000004.mdmp\n 00000000-00003624.00000001.222678.07520000.00000004.mdmp\n Observed string: \"werShell\\v1.0\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003624.00000000.221650.00E50000.00000004.mdmp\n Observed string: \"e35\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003624.00000000.221650.00E50000.00000004.mdmp\n 00000000-00003624.00000001.222678.00E73000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\root\\cimv2; Source: \"00000000-00002332.00000000.220991.00810000.00000004.mdmp, 00000000-00002332.00000001.221041.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"ReAgentc.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 6DC50000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00006616-00000C2C-2401189685\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00003624.00000001.222678.08330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")\n Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")\n Found api reference \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")\n Found api reference \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")\n Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")\n Found api reference \"BCryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")\n Found reference to API \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$3d","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003624.00000001.222678.08330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003624.00000001.222678.07520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$3e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99991","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$3f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$40","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003624-00000C2C-2403823107\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003624-00000C2C-2404931186\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"C:\\Users\\HAPUBWSGetUserNameExW\" (Source: \"00000000-00002332.00000000.220991.05800000.00000004.mdmp, 00000000-00002332.00000001.221041.05800000.00000004.mdmp\")\n Found string \"GetUserNameExW\" (Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")\n Found string \"GetUserNameExA\" (Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003624-00000C2C-2403823107\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003624-00000C2C-2404931186\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSOpenServerW\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")\n Found reference to API \"WTSOpenServerA\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00002868.00000000.222619.03312000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"9465118477,7832,3153,,GetLocaleInfoW,kernel32.dll,\"00:57:42.671\",RX=0,PX=0\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003624.00000000.221650.00F33000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003624.00000001.222678.01031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"EnumDateFormatsW\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00002868.00000001.222870.03312000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002332-00000C2C-2391756679\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00001296.00000001.222766.04800000.00000004.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00001884.00000000.228346.04400000.00000004.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00002868.00000001.222870.05C00000.00000004.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00003624.00000001.222678.01031000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003624.00000001.222678.01031000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003624.00000001.222678.01031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00003624.00000001.222678.00E73000.00000004.mdmp\")\n Found string \"sha1fornonsecretpurposes\" (Indicator: \"secret\"; Source: \"00000000-00003624.00000001.222678.08330000.00000004.mdmp\")\n Found string \"passwordderivebytes\" (Indicator: \"password\"; Source: \"00000000-00003624.00000001.222678.08920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00003624.00000000.221650.01021000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003624)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00003624.00000001.222678.08C1B000.00000004.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00003624.00000001.222678.08C1B000.00000004.mdmp\")\n Found string \"DisableIntrusionPreventionSystem\" (Indicator: \"disableintrusionpreventionsystem\"; Source: \"00000000-00003624.00000001.222678.08C1B000.00000004.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00003624.00000001.222678.08C1B000.00000004.mdmp, 00000000-00003624.00000001.222678.6EFA1000.00000020.mdmp\")\n Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00003624.00000001.222678.08C1B000.00000004.mdmp, 00000000-00003624.00000001.222678.6EFA1000.00000020.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00003624.00000001.222678.08C1B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilegev\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003624.00000000.221650.00E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00002332.00000001.221041.05D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00002164.00000000.221763.05C80000.00000004.mdmp, 00000000-00002164.00000001.221773.05C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003624-00000C2C-2419661836","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"5fcc6ae192686e696d618901f374ecf8aecc5ae5b591973c8dba2f877f128cf7.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002332.00000000.220991.05D80000.00000004.mdmp, 00000000-00002332.00000001.221041.05D80000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002164.00000001.221773.05C80000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003624.00000000.221650.6EFB5000.00000002.mdmp, 00000000-00003624.00000001.222678.01031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\" www.upx.sourceforge.net\"\n \"ctfmon.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"ApplicationFrameHost.exeRuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"69ece4e9ae9f7a50c90edf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"