26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Marsilia.Generic Sample a3dc7da7ce78… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a3dc7da7ce78…. Malware family: Marsilia.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 13 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a3dc7da7ce78f637667d1f29f27f1489f2ad12ec038f7dec7bed217f5ffac589","keywords":["Malicious","Marsilia.Generic","malware analysis","sandbox report","threat intelligence","a3dc7da7ce78f637667d1f29f27f1489f2ad12ec038f7dec7bed217f5ffac589"],"about":{"@type":"SoftwareApplication","name":"RKNBYPASS.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"a3dc7da7ce78f637667d1f29f27f1489f2ad12ec038f7dec7bed217f5ffac589","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Marsilia.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8e1,Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $updpath" (Indicator: "add-mppreference"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp, 00000000-00005216.00000001.302820.06400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $ProgramFilesX86" (Indicator: "add-mppreference"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp, 00000000-00005216.00000001.302820.06400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $AppData" (Indicator: "add-mppreference"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp, 00000000-00005216.00000001.302820.06400000.00000004.mdmp") Found reference string "Add-MpPreference -ExclusionPath $LocalAppData" (Indicator: "add-mppreference"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp, 00000000-00005216.00000001.302820.06400000.00000004.mdmp")28:T558,"Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872736'}" (UID: 00000000-00004000) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872752'}" (UID: 00000000-00004000) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872768'}" (UID: 00000000-00004000) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872784'}" (UID: 00000000-00004000) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872976'}" (UID: 00000000-00004000) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872864'}" (UID: 00000000-00004000) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872912'}" (UID: 00000000-00004000) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872928'}" (UID: 00000000-00004000) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872944'}" (UID: 00000000-00004000) "Zapret2.0Bypass.exe" called "LoadResource with parameter {'hModule': '1828388864', 'hResInfo': '1829872960'}" (UID: 00000000-00004000)29:T600,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a3dc7da7ce78f637667d1f29f27f1489f2ad12ec038f7dec7bed217f5ffac589.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00005216.00000000.301686.03E12000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005844.00000000.301650.00EF2000.00000002.mdmp") Found reference to API "__imp_WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005844.00000000.301650.00EF2000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006160.00000001.306286.01211000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006160.00000001.306286.01211000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006160.00000001.306286.01211000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006160.00000001.306286.01211000.00000002.mdmp")2a:T43d,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a3dc7da7ce78f637667d1f29f27f1489f2ad12ec038f7dec7bed217f5ffac589.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006160.00000001.306286.01211000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006160.00000001.306286.01211000.00000002.mdmp")2b:T4a4,Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004000.00000000.301637.03340000.00000004.mdmp, 00000000-00004000.00000001.303558.03340000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005216.00000000.301686.03E00000.00000004.mdmp, 00000000-00005216.00000001.302820.03E00000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005844.00000000.301650.035D0000.00000004.mdmp")2c:T80a,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp, 00000000-00005216.00000001.302820.06400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp, 00000000-00005216.00000001.302820.06400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp, 00000000-00005216.00000001.302820.06400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp, 00000000-00005216.00000001.302820.06400000.00000004.mdmp")2d:Tfd5,"" (Indicator: "enumchildwindows"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004000.00000000.301637.03340000.00000004.mdmp, 00000000-00004000.00000001.303558.03340000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005216.00000000.301686.03E00000.00000004.mdmp, 00000000-00005216.00000001.302820.03E00000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005844.00000000.301650.035D0000.00000004.mdmp")33:T1b5d,".ar" Heuristic match: "?8.gr" Heuristic match: "?8.gs" Heuristic match: "b..fm" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Heuristic match: "secom trust.net" Heuristic match: "entrust.net" Pattern match: "www.digicert.com" Pattern match: "http://crl.securetrust.com/stca.crl" Pattern match: "www.entrust.net/cps" Pattern match: "http://crl.xrampsecurity.com/xgca.crl" Pattern match: "www.entrust.net/cps_2048" Pattern match: "www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" Pattern match: "http://crl.comodoca.com/aaacertificateservices.crl" Pattern match: "http://crl.usertrust.com/utn-userfirst-object.crl" Pattern match: "www.camerfirma.com/address" Pattern match: "www.entrust.net/legal-terms" Pattern match: "www.xrampsecurity.com" Pattern match: "http://www.usertrust.comutn-userfirst-object" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.xrampsecurity.com1$0" Pattern match: "http://crl.xrampsecurity.com/xgca.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "microsoft.net/assembly/gac_32/presentationcore/v4.0_4.0.0.0__31bf3856ad364e35/presentationcore.dll" Heuristic match: "resentationframework.aero" Pattern match: "http://www.usertrust.com1" Pattern match: "http://www.chambersign.org10" Heuristic match: "putin@kremlin.ru" Heuristic match: "m .ph" Pattern match: "0www.entrust.net/cps" Pattern match: "http://www.quovadisglobal.com/cps0" Pattern match: "http://crl.chambersign.org/chambersroot.crl0" Pattern match: "cps.chambersign.org/cps/chambersroot.html0" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://policy.camerfirma.com0" Pattern match: "http://crl.globalsign.net/root-r2.crl" Pattern match: "http://crl.comodo.net/aaacertificateservices.crl" Pattern match: "http://crl.chambersign.org/chambersroot.crl" Pattern match: "https://ocsp.quovadisoffshore.com" Pattern match: "https://ocsp.quovadisoffshore.com0" Pattern match: "http://www.quovadis.bm0" Pattern match: "http://www.chambersign.org" Heuristic match: "chambersroot@chambersign.org" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "https://repository.luxtrust.lu0" Pattern match: "https://dns.google/resolve?name=google.com" Pattern match: "https://dns.google/resolve?name=dns.google" Heuristic match: "w64\stdole2.tl" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "salator.es" Pattern match: "http://o.pki.goog/s/we1/i9e0%" Pattern match: "http://i.pki.goog/we1.crt0#" Pattern match: "http://c.pki.goog/we1/jkijdkdqfbc.crl0" Pattern match: "http://i.pki.goog/r4.crt0+" Pattern match: "http://c.pki.goog/r/r4.crl0" Pattern match: "http://i.pki.goog/gsr1.crt0-" Pattern match: "http://c.pki.goog/r/gsr1.crl0" Pattern match: "https://dns.google/resolve?name=salator.es" Pattern match: "http://o.pki.goog/s/we1/i9e" Pattern match: "http://i.pki.goog/we1.crt" Pattern match: "http://c.pki.goog/r/r4.crl" Pattern match: "http://i.pki.goog/gsr1.crt" Pattern match: "http://c.pki.goog/r/gsr1.crl" Pattern match: "https://salator.es/sa1at/" Pattern match: "http://o.pki.goog/wr2" Pattern match: "http://i.pki.goog/r1.crtglobalsign" Pattern match: "http://c.pki.goog/r/r1.crl0" Pattern match: "http://o.pki.goog/wr20%" Pattern match: "http://i.pki.goog/wr2.crt0" Heuristic match: "dns.google.com" Heuristic match: "*.dns.google.com" Pattern match: "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0" Heuristic match: "ma.aw" Pattern match: "http://i.pki.goog/r1.crt0+" Heuristic match: "%%7.fj" Heuristic match: "kci>c.,ccirx&.hk" Heuristic match: "//>.gi" Pattern match: "https://github.com/llvm/llvm-project.git" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings"4d:T3d3e,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00002900.00000001.305150.06800000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004000.00000000.301637.03340000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004000.00000001.303558.03340000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005216.00000000.301686.03E00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmxfffff333333ffffff2g'uarizona1scottsdale1%0" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00005216.00000000.301686.06400000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00005216.00000000.301686.06500000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00005216.00000000.301686.06500000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00005216.00000000.301686.06500000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00005216.00000000.301686.06500000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?jp1%0" - Source: "00000000-00005216.00000000.301686.06500000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," (Indicator: "GetDC"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000096.00000000.303114.00800000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000096.00000000.303114.05900000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001320.00000000.301892.03000000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002900.00000000.304636.042F0000.00000004.mdmp")4f:T504,Found registry query API: "RegOpenKeyExW" in "00000000-00002900.00000001.305150.06800000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002900.00000001.305150.06800000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005216.00000000.301686.06400000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005216.00000000.301686.06400000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005844.00000000.301650.00EF2000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005844.00000000.301650.00EF2000.00000002.mdmp" Found registry query API: "__imp_RegOpenKeyExW" in "00000000-00005844.00000000.301650.00EF2000.00000002.mdmp" Found registry query API: "__imp_RegQueryValueExW" in "00000000-00005844.00000000.301650.00EF2000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006160.00000001.306286.01211000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00006160.00000001.306286.01211000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006160.00000001.306286.01211000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006160.00000001.306286.01211000.00000002.mdmp"50:T8c5," www.upx.sourceforge.net\"\n \"conhost.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Zapret2.0Bypass.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a24090e3c25c1cee400acef"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"