34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 65:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Fragtor.Generic Sample fdc247689570… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fdc247689570…. Malware family: Fragtor.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 20 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fdc247689570055e117be90bb8d8ff47811e414c9ebf52d43fa0bce6f27efd86","keywords":["Malicious","Fragtor.Generic","malware analysis","sandbox report","threat intelligence","fdc247689570055e117be90bb8d8ff47811e414c9ebf52d43fa0bce6f27efd86"],"about":{"@type":"SoftwareApplication","name":"fdc247689570055e117be90bb8d8ff47811e414c9ebf52d43fa0bce6f27efd86.bin","applicationCategory":["peexe","executable"],"identifier":"fdc247689570055e117be90bb8d8ff47811e414c9ebf52d43fa0bce6f27efd86","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Fragtor.Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":20,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T1285,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005260.00000000.125481.008B0000.00000004.mdmp, 00000000-00005260.00000000.125481.071F0000.00000004.mdmp, 00000000-00005260.00000001.126530.008B0000.00000004.mdmp, 00000000-00005260.00000001.126530.071F0000.00000004.mdmp, 00000000-00005260.00000001.126530.072BD000.00000004.mdmp, 00000000-00005260.00000001.126530.0863C000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005260.00000000.125481.008B0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00005260.00000000.125481.008B0000.00000004.mdmp, 00000000-00005260.00000001.126530.008B0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00005260.00000000.125481.008B0000.00000004.mdmp, 00000000-00005260.00000000.125481.04B50000.00000004.mdmp, 00000000-00005260.00000001.126530.008B0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp, 00000000-00005260.00000000.125481.071F0000.00000004.mdmp, 00000000-00005260.00000001.126530.071F0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($_.Exception,"NewTemporaryFileWriteError", "WriteError", $env:TEMP)" (Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found string "System.Management.AutomationL" (Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found string "??\C:\WINDOWS\symbols\dll\System.Management.Automation.pdb" (Source: "00000000-00005260.00000001.126530.071F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation." (Source: "00000000-00005260.00000001.126530.08689000.00000004.mdmp")37:T9e2,file/memory contains long string with (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found string "# valid values (supported on all paltforms where Format-Hex is avaliable)" (Indicator: "Format-Hex"; Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp, 00000000-00005260.00000001.126530.08689000.00000004.mdmp") Found string "# 170..180 | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found string "# PS# 170..180 | format-hex -Raw" (Indicator: "Format-Hex"; Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp")38:Taa9," HTTP/1.1 302 Found Date: Tue 03 Feb 2026 16:53:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c8372288e7f17ec-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=72a372e239ccd59713fef3ecac1d56dd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=D0jCWU3XM49WAp3VwQD2O9ynIJybea30ACfXdznWlow-1770137621-1.0.1.1-A1xisIQIFngEpqhHrtzA.TK0brKw8UmSyJ.1o2LzS9kgHkmAM3uIusjAxWqBAvU6RaIPtjGF3qyOiSDLPX89.sjUkCLu96beJfGmifWVYMQ; path=/; expires=Tue 03-Feb-26 17:23:41 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=OZvqTRcur3k4nDgcfjRaAkBFOKEVXQ2kuFzrFYMG9X0-1770137621996-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-/qDKGeLlETogPtD+jfV5bA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-44-lb-gprd gitlab-sv: web-gke-us-east1-c nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 1 ratelimit-remaining: 499 ratelimit-reset: 1770137640 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c837228a7b817ec-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c837228a7b817ec-ATL x-runtime: 0.050360 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 16:53:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6505 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c8372299f0917ec" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=Z2.1gs164yR3X_k0He0fW7Rgi069cVxcxjqf.Gdb9mg-1770137622-1.0.1.1-VzhYRWUydLQuH6gWFN2FEkxa0OJW62iH69t_i2inawqHJMJaDNuPErL5n2HJlxi4g0Bk_hBlxEGzGo_Kppygnm9OSmwXlPx5AyPLFA9IB5g; path=/; expires=Tue 03-Feb-26 17:23:42 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H%2BSDGHnLZCZDXwGWtequyamIdEQWsc1yfnG3tzs6Yc%2Fo2tmoq5gi4JU8QBH2SaToXuKyOeqkfCFc0VI%2FQUhhWwIJlEkbdzr3%2BI%2BdKWtPMEb8U7TyuvZREMdmuFU%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c8372299f0917ec-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 03 Feb 2026 16:53:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c83722aff90ea80-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=0e6a187d580268a91825be26da93cfaa; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=xm77l9J9BpJP27.7tcMACfEFM6B6Pa84coX6Ghz6laI-1770137622-1.0.1.1-3rHIasR5vPl6HL1KgDvV8UE1BPsW4pc_oGO7YDuPeK2Mz4UagG69Ri_BVSI20jsUb5YB_3r1JOtcfu4bWeBbEa_Um0L.79j3Bps80xR79_g; path=/; expires=Tue 03-Feb-26 17:23:42 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=KupMhLmcIGPDvzPJKMNEGTOlvWyesssw0f6ZwIWF2OA-1770137622378-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-hVrdVlbi0wjwNMap9P3Nbw=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-36-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 2 ratelimit-remaining: 498 ratelimit-reset: 1770137640 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c83722b0369ea80-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c83722b0369ea80-ATL x-runtime: 0.048734 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 16:53:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6505 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c83722bfa27ea80" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=eqzAGcHrEVV8BFlOjOLo1wRUGrVgXCk81BqwH7G7Pro-1770137622-1.0.1.1-RcmP53aiIWGVpvzGMNxdUl2rHPUNQ93kqGKpuzDVx4JAIlKuRqHgJZ3IpROEULOSRmnAaxZvO1Lq_nbwEJJo1cZf6TJJhROIpoYMBXKZaRg; path=/; expires=Tue 03-Feb-26 17:23:42 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PoUVz5GpwvbKBIhi7mSX%2FhZZj9UTIoAp0SpWbj3q89jEGZdxgDUZFa1xe0Q6OQ%2FFWjljCuuwGIDVVL1JPoPyU5OMXbUGU4Yon2drWr4IT6WLuNxkWEWGykEiwj0%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c83722bfa27ea80-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 03 Feb 2026 16:53:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c83722c383b5024-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=bb6ac208ad49ad321433a3df80485a88; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=aPomudaym5p65oZ0ph8d7fQ5Itw0.0m_4GLjbaKLLDs-1770137622-1.0.1.1-GQAVEVLqvHUr1V9tMmEc0kM8Nwl4S8leqxcoh_AlH0iDOOaaFx7fKNGQppU_khq.7fYl8l.1PZFPuEQ5z_qgwdro.n_TzCSXZkEMrnvy.uY; path=/; expires=Tue 03-Feb-26 17:23:42 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=3LJl0L_.1zsORAmCA2D4maVB8j1xEKT_Ik5WzwBuQPE-1770137622611-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-u2ZJCyXlV6e9zeapywtwCQ=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-18-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 3 ratelimit-remaining: 497 ratelimit-reset: 1770137640 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c83722c532e5024-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c83722c532e5024-ATL x-runtime: 0.069339 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 16:53:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6505 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c83722d69545024" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=Qyv9hZorzQJ5bnrUhOoWy7UBxjJvg_JMUvhdF_RLqHA-1770137622-1.0.1.1-lobuZ9Tqkcx_FFwyu3xPBKkG8fBtubCYaVvx9eFc_k8XDdcrn3iUR6BAQk.yxegOt9eBgBHw8i9lhaFxSafNTuVXSP0gObt4ftIm5xVilqo; path=/; expires=Tue 03-Feb-26 17:23:42 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5mQv7veCwSjDff0iYzOKUWFOqNXSU75M2aBneOH7c6ImcC3TN0iDo5CHWKJaSLLm6zqaOL2VPUeB%2FeEmlQmsauERIjh0PlrzvRshZNPFjiRCD09qn%2FMSXXRjpKI%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c83722d69545024-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 03 Feb 2026 16:53:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c83722dbd4fc487-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=52428bb756c0af2284992c777297d2a6; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=ESOy716exI01s3pN64_PwZ0S8IFyEUzFX1O.2l9f0.s-1770137622-1.0.1.1-uNQ6VC0tnRTPlyjxNoqzPnc7YuUZ8nPTT5rVTfH5v0t3LzC1K9eOgx5sQ6T5ifFBP6sKlyVlI.x.uTUqgFnq2jyUh39SgGbDdWrsghkx50c; path=/; expires=Tue 03-Feb-26 17:23:42 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=zWV4fcqKTIsPUGfBl9Wm9uo5eot8BCIn_hmGGrSFamQ-1770137622828-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-6SnPWdwtam+y100CFkicUQ=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-32-lb-gprd gitlab-sv: web-gke-us-east1-c nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 4 ratelimit-remaining: 496 ratelimit-reset: 1770137640 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c83722dd4d4c487-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c83722dd4d4c487-ATL x-runtime: 0.055277 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 16:53:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6526 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c83722f0fafc487" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=_1GEA3XUx7uoKcidU_1jOwkCYUK7o5sgAZB5WZOybRc-1770137622-1.0.1.1-yHOSML2R2sUWI1pF87tJsyQYqBUq4uRqA0pY6Tl.EGMrS5_kKQwD3MQ9BTMd9X8rbg7in8mOyBUq10kJf8Z9BErSXDMLV1KADpqjLxzheoc; path=/; expires=Tue 03-Feb-26 17:23:42 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Ch6g5zgeR0fNYxx6pOcyem0kx3KBRNGvXlW1hFpI9y%2BTdIWucUg%2FHiM%2FlrfsmQn%2F6n4Zf%2BLRzKkqiMWZmtH%2FmABup5uw7PE8mlPa1AFNk9fGZIYNC3ySOFOFhQ%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c83722f0fafc487-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 03 Feb 2026 16:53:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Server: cloudflare Location: https://gitlab.com/users/sign_in CF-Ray: 9c83722f4e3c760e-SJC CF-Cache-Status: MISS Cache-Control: no-cache Set-Cookie: _gitlab_session=88b945ac23860d039195be13591a5109; path=/; secure; HttpOnly; SameSite=None Set-Cookie: __cf_bm=gCk1ts7BSyrVoVrKsyCusrv5p5z6MwAO9LtFH9AE7ro-1770137623-1.0.1.1-SF6.3vZbWuO1u73TFE57dZYNVYITs0WckCWZPyUquAf3_y5IeEzVmIx2foKDYWhw3a9b.gJydd2t0w66LY_YEDp2UtiPj2hhz1x3qbB8Qtc; path=/; expires=Tue 03-Feb-26 17:23:43 GMT; domain=.gitlab.com; HttpOnly; Secure Set-Cookie: _cfuvid=U_g6cUX6VA2L2IMWDE9qYoiYVW1Xv6Pi_cSG412ObsQ-1770137623089-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-pMC7hKLChITZlhB5xo3Zyg=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-45-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 5 ratelimit-remaining: 495 ratelimit-reset: 1770137640 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9c83722f62a6760e-ATL" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9c83722f62a6760e-ATL x-runtime: 0.064260 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 03 Feb 2026 16:53:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6526 Connection: close accept-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cf-mitigated: challenge critical-ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 permissions-policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() referrer-policy: same-origin server-timing: chlray;desc="9c837230687b760e" x-content-type-options: nosniff x-frame-options: SAMEORIGIN Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Set-Cookie: __cf_bm=D9Bu8cbVNtXBIai5yZQiWIe9Y1I9EJRkVwLvsu0LU.k-1770137623-1.0.1.1-ZNeOZOv4YHKyBVwO_T9C2IB.Q0a.MbRsLzqBPb5eR_Vv3Woj1RbaJwcuswtDwIBceguf37k2Pb8KyODbDyyMzjwgZnw2HR4AJPrAwDmkUJM; path=/; expires=Tue 03-Feb-26 17:23:43 GMT; domain=.gitlab.com; HttpOnly; Secure Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0VRemjOtxo3%2F5sX%2FN2KKRFHGX9HPb41y63It1DORK9cdeRawJGqCjMQYPoyLJEOBLeVNCX9dZZ6AIn9nUknGq8ZBs7CDS4oVUBhPKr1oOEmj3rKc2K1fUQ%2FgcSg%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Strict-Transport-Security: max-age=31536000 Server: cloudflare CF-RAY: 9c837230687b760e-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C.......49:T4e42,"9iqmgvw,czcthawte," - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005260.00000000.125481.00990000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005260.00000000.125481.00C60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005260.00000000.125481.00C60000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0l*ur1.3.132.0.34@eckpl*url*url*url*urxmm)1.3.6.1.4.1.311.2.1.251.3.14.3.2.261.3.132.0.10ecdp1.3.132.0.34ecdp1.3.132.0.35@eckp" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mne" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00005260.00000000.125481.071F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>wrcasmwrcasm9iqmgvw,czcthawte," - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e6n5]f" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005260.00000001.126530.00990000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005260.00000001.126530.071F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00005260.00000001.126530.071F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005260.00000001.126530.071F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0vrnamepropvrnamepropvrnamepropvrnamepropvrnamepropvrnameprop@xvrnameprop8zvrnameprop@s-vrnamepropl*urvrnamepropvrnamepropvrnamepropvrnamepropvrnamepropvrnamepropgitlab.comgitlab.com2r" - Source: "00000000-00005260.00000001.126530.072BD000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005260.00000001.126530.08610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!" - Source: "00000000-00005260.00000001.126530.08610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00005260.00000001.126530.08689000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0aspnlicyultutivi" - Source: "00000000-00005260.00000001.126530.08689000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0q://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005260.00000001.126530.08777000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005260.00000001.126530.08777000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertruuctswashington1redmond1orporation1-0+$microsoft" - Source: "00000000-00005260.00000001.126530.08794000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microsoftrooef1.3.6.1n:'-aowashington1microsoft" - Source: "00000000-00005260.00000001.126530.08794000.00000004.mdmp") Found URL "http://microsoft.com0hj9hsil!utngg!v8washington1redmond1soft" - Source: "00000000-00005260.00000001.126530.08794000.00000004.mdmp") Found URL "http://crl.microsoft/crl/products/miccerlisca2011_2011-03-29.crl0]ahttp://www.microsoft.com/pki/certs/miccerlisca1-03-29.crt0>wr" - Source: "00000000-00005260.00000001.126530.08794000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005260.00000001.126530.6F561000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007164.00000000.126179.00900000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007404.00000000.125612.00800000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00007404.00000000.125612.06080000.00000004.mdmp") Found URL "http://repository.swisssign.com/0aun" - Source: "00000000-00007404.00000000.125612.06080000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007404.00000001.125623.00800000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00007404.00000001.125623.06080000.00000004.mdmp") Found URL "http://repository.swisssign.com/0aun" - Source: "00000000-00007404.00000001.125623.06080000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007424.00000000.126478.03250000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007424.00000001.126608.03250000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmentrust," - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?jp1%0" - Source: "00000000-00007424.00000001.126608.05800000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,] [-EncodedCommand ]" (Indicator: "base64"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00005260.00000001.126530.01131000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.01131000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.01131000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.01131000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.01131000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.01131000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.01131000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.01131000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.01131000.00000020.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00005260.00000001.126530.072BD000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256factory" (Indicator: "aes"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256factory" (Indicator: "aes256"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256encryptionkey" (Indicator: "aes"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256encryptionkey" (Indicator: "aes256"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256algorithm" (Indicator: "aes"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256algorithm" (Indicator: "aes256"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes256"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sqlaes256cbcfactory" (Indicator: "aes"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sqlaes256cbcfactory" (Indicator: "aes256"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.085F0000.00000004.mdmp, 00000000-00005260.00000001.126530.08A70000.00000004.mdmp, 00000000-00005260.00000001.126530.08AB0000.00000004.mdmp, 00000000-00005260.00000001.126530.08AD0000.00000004.mdmp, 00000000-00005260.00000001.126530.08AE0000.00000004.mdmp, 00000000-00005260.00000001.126530.08F20000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00005260.00000001.126530.085F0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000001.126530.085F0000.00000004.mdmp, 00000000-00005260.00000001.126530.08A70000.00000004.mdmp, 00000000-00005260.00000001.126530.08AB0000.00000004.mdmp, 00000000-00005260.00000001.126530.08AD0000.00000004.mdmp, 00000000-00005260.00000001.126530.08AE0000.00000004.mdmp, 00000000-00005260.00000001.126530.08F20000.00000004.mdmp")5c:T683,Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "$foundAccess | Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00005260.00000001.126530.08689000.00000004.mdmp")5d:Tcb5,file/memory contains long string with (Indicator: "Get-Command"; File: "AMSI") Found string "if (Get-Command Add-MpPreference -ErrorAction SilentlyContinue) {" (Indicator: "Get-Command"; Source: "00000000-00002976.00000000.133647.04C00000.00000004.mdmp") Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-PSDrive" (Indicator: "Get-PSDrive"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-ItemProperty" (Indicator: "Get-ItemProperty"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp") Found string "Get-Service" (Indicator: "Get-Service"; Source: "00000000-00005260.00000000.125481.04B50000.00000004.mdmp")5e:T5b9,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00005260.00000001.126530.008B0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00005260.00000001.126530.008B0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00005260.00000001.126530.008B0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00005260.00000001.126530.08180000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00005260.00000001.126530.08A70000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00005260.00000001.126530.08A70000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00005260.00000001.126530.08AB0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00005260.00000001.126530.08AB0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00005260.00000001.126530.08AD0000.00000004.mdmp")5f:Tcb9," www.upx.sourceforge.net\"\n \"mitmdump.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"698227dca00f878a35004967"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"2008-06-22T12:00:00true\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00005260.00000001.126530.08610000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"LogonTrigger\"; Source: \"00000000-00005260.00000001.126530.0863C000.00000004.mdmp\")\n Found string \"!-- SetLogonTrigger -->\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00005260.00000001.126530.0863C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"698227dca00f878a35004967"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"