34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 68:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 79c6abe8b18b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 79c6abe8b18b…. Malware family: Trojan.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 19 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060"],"about":{"@type":"SoftwareApplication","name":"79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin","applicationCategory":["peexe","executable"],"identifier":"79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":19,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T8c3,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003764.00000000.149368.035A0000.00000004.mdmp, 00000000-00003764.00000001.150586.035A0000.00000004.mdmp, 00000000-00003764.00000001.150586.07C50000.00000004.mdmp, 00000000-00003764.00000001.150586.09410000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" (Source: "00000000-00003764.00000000.149368.035A0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00003764.00000000.149368.035A0000.00000004.mdmp, 00000000-00003764.00000001.150586.035A0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00003764.00000000.149368.035A0000.00000004.mdmp, 00000000-00003764.00000001.150586.035A0000.00000004.mdmp") Found string "/System.Management.Automation.resources/System.Management.Automation.resources" (Source: "00000000-00003764.00000000.149368.0367F000.00000004.mdmp") Found string "essage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($exception,"FormatHexFileAccessError", ([System.Management.Automation.ErrorCategory]::ReadError), $targetFilePath)" (Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found string "$ast = [System.Management.Automation.LanguE;" (Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found string "??\C:\WINDOWS\symbols\dll\System.Management.Automation.pdb" (Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found string "NDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp")37:T5e3,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp")38:T5cd,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp")39:Ta8b,"=0 ORDER BY iLang" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "select ilang, cfrom, cto, icost from "%w" where ilang>=0 order by ilang") "SELECT idx,count(*) FROM %Q.sqlite_stat4 GROUP BY idx COLLATE nocase" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "select idx,count(*) from %q.sqlite_stat4 group by idx collate nocase"), "CREATE TABLE x(_shape" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "create table x(_shape") "UPDATE OR %s "%w"."%w_vocab" SET id=%lld, rank=%d, langid=%d, word=%Q, k1=nullif(%Q,%Q), k2=%Q WHERE id=%lld" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "update or %s "%w"."%w_vocab" set id=%lld, rank=%d, langid=%d, word=%q, k1=nullif(%q,%q) k2=%q where id=%lld"), "DELETE FROM "%w"."%w_vocab" WHERE id=%lld" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "delete from "%w"."%w_vocab" where id=%lld"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "select*from"%w".%s order by rowid"), "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "select*from"%w".%s where %s order by rowid"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "UPDATE %Q.sqlite_master SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE x(%.*s INT" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "create table x(%.*s int") "SELECT %s FROM %s AS T" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "select %s from %s as t") "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "delete from %q.%s where %s=%q") "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "delete from %q.sqlite_sequence where name=%q") "SELECT * FROM %Q.%Q" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "select * from %q.%q") "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q") "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT %s FROM %s T WHERE T.%Q <= ? AND T.%Q >= ? ORDER BY T.%Q DESC" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "select %s from %s t where t.%q <= ? and t.%q >= ? order by t.%q desc"), "SELECT %s FROM %s T WHERE T.%Q >= ? AND T.%Q <= ? ORDER BY T.%Q ASC" (Source: 00000000-00002420.00000002.152947.27740000.00000004.mdmp, 00000000-00002420.00000002.152947.29780000.00000004.mdmp, Indicator: "select %s from %s t where t.%q >= ? and t.%q <= ? order by t.%q asc")47:T51e0,Found reference to API (Indicator: "GetProcessAffinityMask"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "WerGetFlags"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetThreadContext"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SetEvent"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "WriteFile"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetProcAddress"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetStdHandle"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SuspendThread"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "ResumeThread"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "VirtualFree"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SwitchToThread"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SetThreadContext"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "CloseHandle"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "VirtualQuery"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "CreateThread"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SetWaitableTimer"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "ExitProcess"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "CreateEventA"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "WerSetFlags"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetErrorMode"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "RaiseFailFastException"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "TlsAlloc"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "CreateFileA"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SetErrorMode"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "SetTimer"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "WSAIoctl"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "OpenFile"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetLength"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "ShowWindow"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "GetVersion"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002420.00000000.149106.03712000.00000004.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00002420.00000000.149106.03712000.00000004.mdmp") Found reference to API (Indicator: "SessionEnv"; Source: "00000000-00002420.00000001.151029.0372B000.00000004.mdmp, 00000000-00002420.00000002.152947.0372B000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp, 00000000-00003764.00000001.150586.71685000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003764.00000000.149368.00291000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003764.00000001.150586.00281000.00000020.mdmp, 00000000-00003764.00000001.150586.71671000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003764.00000001.150586.00281000.00000020.mdmp, 00000000-00003764.00000001.150586.71671000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003764.00000001.150586.00281000.00000020.mdmp, 00000000-00003764.00000001.150586.71671000.00000020.mdmp")48:Tbe4,"$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: AMSI "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 33588-159-0028D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 33588-194-00288190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 33588-194-00288190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 33588-194-00288190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 33588-196-0028BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 33588-207-00288AF0 "\??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002420.00000001.151029.0372B000.00000004.mdmp 00000000-00002420.00000002.152947.0372B000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00002420.00000001.151029.0372B000.00000004.mdmp 00000000-00002420.00000002.152947.0372B000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00002420.00000001.151029.09700000.00000004.mdmp 00000000-00002420.00000002.152947.09600000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003608.00000000.157343.04000000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00003608.00000000.157343.04000000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003764.00000000.149368.035A0000.00000004.mdmp 00000000-00003764.00000001.150586.035A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003764.00000000.149368.035A0000.00000004.mdmp 00000000-00003764.00000001.150586.035A0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00003764.00000000.149368.0367F000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003764.00000001.150586.00281000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003764.00000001.150586.00281000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003764.00000001.150586.00281000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003764.00000001.150586.00281000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003764.00000001.150586.00281000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003764.00000001.150586.00281000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003764.00000001.150586.07C50000.00000004.mdmp49:T8db,Process HTTP/1.1 302 Found Date: Tue 03 Feb 2026 17:00:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c837c4558777aee-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=adea4c178169d7a09304b50336d08d57; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=fv0xGZrbM55Yg8oijA6VxNTv3mNa4N9W0xP3Rpej1fU-1770138036-1.0.1.1-.0EDq1a2cpF0b6MgcgIXbt8cp4nPhIOT6uoM9Jt9s4g5ATYt1pFciloBfnz3aHqWYvjvLbmMOhqVtwrM7OjmhxLnuf.DiCQ4IPwXxsQ4KCk; path=/; expires=Tue 03-Feb-26 17:30:36 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=Qy1Dr6ziAMpCZVuOwVp2axkC0Jn7IfqNGKF.W.ZldW4-1770138036214-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-aGtQ7QlCYSIqKx65mdQ3RQ=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-43-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 1 ratelimit-remaining: 499 ratelimit-reset: 1770138060 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c837c45737c7aee-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c837c45737c7aee-ATL x-runtime: 0.051125 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 17:00:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6526 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c837c4678c17aee" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=OELkp.k3f_2wX4TrQ11sWAe02JnkG8t76eYgtY7WW8E-1770138036-1.0.1.1-4xB.Ada1GjaY1HHtzwDswyfs_Aoqe6i8bshbFe0DQ.6VD8sNa8w1jrTaTzIiTidYqTJa83hKlcOmJ_u8r74a8zLmQj3y3WKh1Sg298s4ZzQ; path=/; expires=Tue 03-Feb-26 17:30:36 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1iW7uRPIMVIYCm5ZSh0B8nU1JOSv50VgMclJz8Q7JciOQ%2F07Ciz%2F4bf8N8utoAt1lOfXPQ%2FB4w05K9tn5hmQw2tszCsSUtSuB32a2yeY%2FmpRtZemR8B68nMDB%2Bw%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c837c4678c17aee-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 03 Feb 2026 17:00:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c837c4b3b2367a6-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=275f90a1ece81539f6a39f7080d437b3; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=qttT27Sk76iImw_b1W5petahkko1Y7yH.mCT3FtyHy8-1770138037-1.0.1.1-WpDPfimu87jSp5HZvnHapiINndo5oduQM4aoAyFr.Kx255NXIIvQ2gbRbUKMQKypI4mPalouEfHCYfiOovXcYYk5LgIGEVe5MFjxdRKWu6c; path=/; expires=Tue 03-Feb-26 17:30:37 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=aegdw2x3_cYPYH8QlcxNvAvYLnbfVWDT99tyb28zx6U-1770138037148-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-Chhi/rjWHfhzqig8Jm/gAw=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-04-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 2 ratelimit-remaining: 498 ratelimit-reset: 1770138060 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c837c4b474e67a6-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c837c4b474e67a6-ATL x-runtime: 0.052339 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 17:00:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6505 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c837c4c4b8567a6" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=0I3i3LmZ_Mzrt0KVs0c9h5AW_CrHUMGZZ4jJxsA62xg-1770138037-1.0.1.1-GRAizHkC5oZiZWYMbxS3aSFl__BttISwGHgsoHbR3_cD6sjZXhb4xSQl.MZaauSk2Bpvv9ma.BXQT6GOONe7I2b4gY5mbPt0pMTOc2FZS7Q; path=/; expires=Tue 03-Feb-26 17:30:37 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iMbDiv%2BO69cSIhR0maZg8Voay7Qy%2BGKkwm2d%2Fp6BnCBE1ow%2BrXipIRzHn44OpipcAkvMZhHVwApknUDHFVCsm7f4bLGi5nFP0Pkl%2BCD0ExhFWq13vru68sHgl7I%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c837c4c4b8567a6-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 03 Feb 2026 17:00:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c837c4c99069465-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=1d97738bd834934f2b492d6d166e15dc; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=Cu7T3N9s_lr1V.6H4F_324ct8EEmXejgea7JZ2u6BEA-1770138037-1.0.1.1-ksDUB6.kEZ9CCQmjebqHfPsMqkg0fDMrqgBP1H1P_t4cw73EN5iTmyFcfo5IO4zP6_vLq5n6xt4pAwu3IiyFWs2ZOaJWG9m_bIYcFxgRH04; path=/; expires=Tue 03-Feb-26 17:30:37 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=2RW8t8e.F9x4EjzQgaQ2FO3QIWlg_I_tdRKFUvmyXWI-1770138037389-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-jMMZWIgC9mmgzNxABBLU0A=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-23-lb-gprd gitlab-sv: web-gke-us-east1-c nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 3 ratelimit-remaining: 497 ratelimit-reset: 1770138060 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c837c4cb60c9465-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c837c4cb60c9465-ATL x-runtime: 0.063592 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 17:00:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6526 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c837c4dc9dc9465" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=0b5NlTLMRffXkn_3fDYUbBgDbi9LAeqiqUhFxktpKUA-1770138037-1.0.1.1-TfRMgpLqIuM5tdg0wywibKTwXQo7E.PK2sPw92SFUIL0acXs8fbaF81ypMhKNKgH4A_Jx5_A_K4wm2wFJUVAisfekoPAoI_NKhMp0WlBgng; path=/; expires=Tue 03-Feb-26 17:30:37 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q8VjQjPAh0ib%2BPCvrx0tbSCsfHKy169Vd1E%2FWz%2FVbHFEEX8B89N1OcPMjRIveNDzLN%2FSe%2Bkz%2BfnJxogiCRpaDraMqzTCNP4hMU2XFqz%2BtBR%2FI1UuYMWsJlRVTRE%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c837c4dc9dc9465-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 03 Feb 2026 17:00:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c837c4e3fb9810a-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=b130479d48e8e296a4f938c92c11776f; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=QTwIzDyTnydtDoiJcQ2kxRopypsuu_0Vt2500pjkTW0-1770138037-1.0.1.1-koBZMYWrDFkuuINmj9HsDTxMwvj0JcWZ0p3nMJZdou0h.cI91ItPKypIexsC3QaWjs_JoAQ_FcT3sPPxv6fKRh6zTVU8MMJIL3ERbTFLMNw; path=/; expires=Tue 03-Feb-26 17:30:37 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=JN64ypLr2atu.3pucJpaNP5NFL_0VXHF9ttCxZhZLYs-1770138037624-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-2wdappduffhyxWHvzfGPkA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-06-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 4 ratelimit-remaining: 496 ratelimit-reset: 1770138060 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c837c4e546b810a-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c837c4e546b810a-ATL x-runtime: 0.052002 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 17:00:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6505 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c837c4f3a13810a" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=nG0ugGX70QAjIoxf33D5QOD9wk7xsIyYdo620.jwCY4-1770138037-1.0.1.1-LBQeIcRzKMPukM3n0ZDNaO2gbhA3KEyJIHwKBy1CXoRp8be0HThNv4DG0.1Qk394bVkQcIFlygfzqio8FkrUGGjzR41BDV7IwrMmxKncHm8; path=/; expires=Tue 03-Feb-26 17:30:37 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0VTJZcSFDOSwzIq1WdZAonyr36yCWy5NjXqrZDfbvtUqL1BnQeQDdRsBVHg2o7iAyOgidT%2BAVM%2BqYKKmjVjHUsLCcyRAbH2KfbynGKIJhQbL8IBynK4Wrazk9pc%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c837c4f3a13810a-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 03 Feb 2026 17:00:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c837c4f9a9a2386-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=3148c8d3d8b65689966c22dbaf8f6a43; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=tDJw5Ro2FsUfHirk.D3faK9f96xqABOBF8iQaljTOJM-1770138037-1.0.1.1-MupXX10itegr9J73irOUdRlgTMhGyyKRFy1eH6dIf5iOI2uBR_i1L7f.QGuupkFnlWZnEPFncrukQGSjBAm7djL5hOYV4ND6YvePkCLrVvA; path=/; expires=Tue 03-Feb-26 17:30:37 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=RLeTx2fdvwHVYoZEXzMqigbR.tNoWRjaBhL1sDXH4KU-1770138037879-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-xN774WOXHatYlHxr/Zh29Q=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-33-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 5 ratelimit-remaining: 495 ratelimit-reset: 1770138060 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c837c4fc5da2386-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c837c4fc5da2386-ATL x-runtime: 0.069812 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 17:00:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6526 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c837c510bca2386" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=_A4Joe..wE84YgoW2geULy9s8U1MJ5uhtRG0hi7gKW4-1770138037-1.0.1.1-pUPJI.N69RtO8o8Pr08PVh7QmBmfHupUeH2jxenDMeuD931xo1G_0rkMn4zCT1S1vS7MHdVyREOcC15xbLljH9BIY7Zxdtzzesdd.xQbre0; path=/; expires=Tue 03-Feb-26 17:30:37 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TtBi0Ygoea3ba6U1zrCHvUqASR34%2FZXKfuo2%2F%2B1Anx%2FcdPEYaiFkY51w9%2FcUoqnIuEvTGGQeENZs1XE3gQ9nkpcUlErQCSWsPorVCeQnIjMew7FLqfzGykLZrFQ%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c837c510bca2386-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C.......4e:T4992,"9iqmgvw,czcthawte," - Source: "00000000-00003764.00000000.149368.0367F000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ef'sk" - Source: "00000000-00003764.00000000.149368.0367F000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00003764.00000000.149368.0367F000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003764.00000000.149368.0367F000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lo0905/^g(o-cejy" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkzl*)rl*)rbc6" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://crl.microsoft.*crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_20:.crt07ya'4ypdjiy()>@6t+a6" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l:odlpdb" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=6" - Source: "00000000-00003764.00000000.149368.07C50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ef'sk" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003764.00000001.150586.0367F000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00003764.00000001.150586.037F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0system.data.dllsystem.data.dlledt+root" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lmvvi," - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.34@eckp1.3.132.0.34ecdp1.3.132.0.35ecdp" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!r" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://www.microsoftay,mbn$i-/h" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-anonicnonic" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "http://icti0l0jroft.com/pki/certs/mictimstaredmft" - Source: "00000000-00003764.00000001.150586.07C50000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/details/421837" - Source: "00000000-00003764.00000001.150586.07D1B000.00000004.mdmp") Found URL "http://pesterbdd.com/images/pester.png" - Source: "00000000-00003764.00000001.150586.07D1B000.00000004.mdmp") Found URL "https://github.com/pester/pester" - Source: "00000000-00003764.00000001.150586.07D1B000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0.html" - Source: "00000000-00003764.00000001.150586.07D1B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0'rxxd" - Source: "00000000-00003764.00000001.150586.07D1B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00003764.00000001.150586.07D1B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crljhttp://cra\r" - Source: "00000000-00003764.00000001.150586.09519000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003764.00000001.150586.0956A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003764.00000001.150586.0956A000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003764.00000001.150586.0956A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003764.00000001.150586.0956A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003764.00000001.150586.0956A000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003764.00000001.150586.0956A000.00000004.mdmp") Found URL "https://collector.prd-278964.gl-product-analytics.com" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://analytics.gitlab.com" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://www.recaptcha.net/" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://www.googletagmanager.com/ns.html" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://*.zuora.com/apps/publichostedpagelite.do" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://gitlab.com/admin/" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://gitlab.com/assetstlab/-/sdex." - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://gitlab.com/-/sandbox/" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://embed.figma.com" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://www.figma.com" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://www.youtube.com;" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd;" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "https://apis.google.com" - Source: "00000000-00003764.00000001.150586.09575000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003764.00000001.150586.71671000.00000020.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=giajq91clfxxudyjkwv50rqzrbfo%2f" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/at40%http://i.pki.goog/we1.crt0" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/we1/ziovfvgujmu.crl0=q2%(mdt" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:r%ycgallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcomspec=c:\windows\system32\cmd.exelocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anvm_symlink=c:\program" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%_itxc&sav*wnor3y/" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0google" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/ooqml@x]" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%_itxc&sav*wsastartup192.168.0.1:53oy+fjzn" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://o.pki.goog/wr2google" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crtglobalsign" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crtglobalsign" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0^s" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%_itxc&qyaj(google" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%_itxc&wnor3y/" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0wnor3y/" - Source: "00000000-00004532.00000000.148759.05800000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=giajq91clfxxudyjkwv50rqzrbfo%2f" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/at40%http://i.pki.goog/we1.crt0" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/we1/ziovfvgujmu.crl0=q2%(mdt" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:r%ycgallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcomspec=c:\windows\system32\cmd.exelocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anvm_symlink=c:\program" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%_itxc&sav*wnor3y/" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0google" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/ooqml@x]" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%_itxc&sav*wsastartup192.168.0.1:53oy+fjzn" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://o.pki.goog/wr2google" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crtglobalsign" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crtglobalsign" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0^s" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%_itxc&qyaj(google" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0=q2%_itxc&wnor3y/" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0wnor3y/" - Source: "00000000-00004532.00000001.148792.05800000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004612.00000000.150247.03500000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00004612.00000000.150247.05C80000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmarizona1scottsdale1%0" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?digicert" - Source: "00000000-00004948.00000000.150868.03C00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00005780.00000000.149582.05D00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00005780.00000000.149582.05D00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00005780.00000000.149582.05D00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?jp1%0" - Source: "00000000-00005780.00000000.149582.05D00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," (Indicator: "GetDC"; Source: "00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003608.00000000.157343.04000000.00000004.mdmp")5e:T931,Found string "secret" (Indicator: "secret"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found string "password" (Indicator: "password"; File: "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin") Found string "master secret" (Indicator: "secret"; Source: "00000000-00002420.00000002.152947.00E97000.00000004.mdmp") Found string "extended master secret" (Indicator: "secret"; Source: "00000000-00002420.00000002.152947.00E97000.00000004.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00003608.00000000.157343.00E97000.00000004.mdmp") Found string "extended master secret" (Indicator: "secret"; Source: "00000000-00003608.00000000.157343.00E97000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00003764.00000001.150586.035A0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00003764.00000001.150586.035A0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00003764.00000001.150586.035A0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00003764.00000001.150586.08A60000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00003764.00000001.150586.08B20000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00003764.00000001.150586.08B20000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00003764.00000001.150586.08B20000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00003764.00000001.150586.08B20000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00003764.00000001.150586.08B40000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00003764.00000001.150586.09280000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00003764.00000001.150586.09280000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00003764.00000001.150586.093A0000.00000004.mdmp")5f:T778,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$38","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003764.00000000.149368.0367F000.00000004.mdmp, 00000000-00003764.00000000.149368.07C50000.00000004.mdmp, 00000000-00003764.00000001.150586.0367F000.00000004.mdmp, 00000000-00003764.00000001.150586.07C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00002420.00000000.149106.03712000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003764.00000000.149368.035A0000.00000004.mdmp\n 00000000-00003764.00000001.150586.035A0000.00000004.mdmp\n Observed string: \"werShell\\v1.0\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003764.00000000.149368.035A0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - 8\\\\.\\u; Source: \"79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"ReAgentc.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 6DF70000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$39","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002420-00000C2C-1323234232\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00003764.00000001.150586.08A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00003764.00000000.149368.07C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$3b","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003764.00000001.150586.08A60000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003764.00000001.150586.09280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"Observed string: \"crypto/tls\" (Indicator: \"crypto/tls\") in Source: 79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\n Observed string: \"crypto/aes\" (Indicator: \"crypto/aes\") in Source: 79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\n Observed string: \"crypto/md5\" (Indicator: \"crypto/md5\") in Source: 79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\n Observed string: \"crypto/des\" (Indicator: \"crypto/des\") in Source: 79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\n Observed string: \"crypto/rsa\" (Indicator: \"crypto/rsa\") in Source: 79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\n Observed string: \"crypto/rc4\" (Indicator: \"crypto/rc4\") in Source: 79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\n Observed string: \"crypto/dsaParameters\" (Indicator: \"crypto/dsaParameters\") in Source: 79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003764.00000000.149368.0367F000.00000004.mdmp, 00000000-00003764.00000001.150586.0367F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$3c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$3d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003764-00000C2C-1324215098\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003764-00000C2C-1325056338\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003764-00000C2C-1324215098\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003764-00000C2C-1325056338\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004532-00000C2C-1312781971\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00004532-00000C2C-1315469611\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00002420.00000000.149106.03712000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003608.00000000.157343.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004532-00000C2C-1312978220\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004532-00000C2C-1312978257\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004532-00000C2C-1312978308\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003764-00000C2C-1326638399\")\n Found reference to API \"rFreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003608.00000000.157343.04000000.00000004.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003608.00000000.157343.04000000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003608.00000000.157343.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003764.00000000.149368.00291000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004532-00000C2C-1313308244\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060.bin\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00003608.00000000.157343.04000000.00000004.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00003764.00000000.149368.00291000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003764.00000000.149368.00291000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003764.00000000.149368.00291000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00003764-00000C2C-1324584510\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00003764-00000C2C-1324584534\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002420.00000000.149106.03700000.00000004.mdmp, 00000000-00002420.00000001.151029.03700000.00000004.mdmp, 00000000-00002420.00000002.152947.03700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"2008-06-22T12:00:00true\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00003764.00000001.150586.07C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"69822978e76c7b548807eff7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"