get https://www.virustotal.com/api/v3/files//behaviours
This endpoint returns behavioural information from each sandbox about the file.
This API call returns all fields contained in the File behaviour object.
Note some of the entries have
has_html_report
if true you may fech the HTML File behaviour.has_pcap
if true you may fech the PCAP File behaviour.
{
"meta": {
"count": 5
},
"data": [
{
"attributes": {
"verdicts": [
"UNKNOWN_VERDICT"
],
"has_pcap": false,
"analysis_date": 1669409515,
"processes_tree": [
{
"process_id": "2248",
"name": "%windir%\\System32\\svchost.exe -k WerSvcGroup"
},
{
"process_id": "2940",
"name": "wmiadap.exe /F /T /R"
},
{
"process_id": "2988",
"name": "%windir%\\system32\\wbem\\wmiprvse.exe"
},
{
"process_id": "2676",
"name": "%SAMPLEPATH%"
}
],
"sandbox_name": "C2AE",
"has_html_report": false,
"processes_terminated": [
"%windir%\\System32\\svchost.exe -k WerSvcGroup",
"wmiadap.exe /F /T /R"
],
"behash": "7eb58e30b74038daa9b31b5d9df78cf2",
"has_evtx": false,
"last_modification_date": 1669495931,
"has_memdump": false
},
"type": "file_behaviour",
"id": "edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_C2AE",
"links": {
"self": "https://www.virustotal.com/api/v3/file_behaviours/edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_C2AE"
}
},
{
"attributes": {
"mitre_attack_techniques": [
{
"signature_description": "link function at runtime on Windows",
"id": "T1129",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"signature_description": "packed with UPX",
"id": "T1027.002",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"refs": [
{
"ref": "#signature_matches",
"value": "link function at runtime on Windows"
}
],
"signature_description": "link function at runtime on Windows",
"id": "T1129",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"refs": [
{
"ref": "#signature_matches",
"value": "packed with UPX"
}
],
"signature_description": "packed with UPX",
"id": "T1027.002",
"severity": "IMPACT_SEVERITY_INFO"
}
],
"has_pcap": false,
"analysis_date": 1669611166,
"sandbox_name": "CAPA",
"has_html_report": false,
"behash": "76c6c8e44cd4f1dbddc0f6c2202c1480",
"has_evtx": false,
"signature_matches": [
{
"format": "SIG_FORMAT_CAPA",
"rule_src": "rule:\n meta:\n name: allocate memory\n authors:\n - [email protected]\n lib: true\n scope: basic block\n mbc:\n - Memory::Allocate Memory [C0007]\n examples:\n - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\n # ntdll\n - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA\n features:\n - or:\n - api: kernel32.VirtualAlloc\n - api: kernel32.VirtualAllocEx\n - api: kernel32.VirtualAllocExNuma\n - api: kernel32.VirtualProtect\n - api: kernel32.VirtualProtectEx\n - api: NtAllocateVirtualMemory\n - api: ZwAllocateVirtualMemory\n - api: NtMapViewOfSection\n - api: ZwMapViewOfSection\n",
"name": "allocate memory",
"authors": [
"[email protected]"
]
},
{
"format": "SIG_FORMAT_CAPA",
"rule_src": "rule:\n meta:\n name: allocate RW memory\n authors:\n - [email protected]\n lib: true\n scope: basic block\n mbc:\n - Memory::Allocate Memory [C0007]\n examples:\n - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\n features:\n - and:\n - match: allocate memory\n - number: 0x4 = PAGE_READWRITE\n",
"name": "allocate RW memory",
"authors": [
"[email protected]"
]
},
{
"format": "SIG_FORMAT_CAPA",
"rule_src": "rule:\n meta:\n name: contain loop\n authors:\n - [email protected]\n lib: true\n scope: function\n examples:\n - 08AC667C65D36D6542917655571E61C8:0x406EAA\n features:\n - or:\n - characteristic: loop\n - characteristic: tight loop\n - characteristic: recursive call\n",
"name": "contain loop",
"authors": [
"[email protected]"
]
},
{
"rule_src": "rule:\n meta:\n name: terminate process\n namespace: host-interaction/process/terminate\n authors:\n - [email protected]\n - [email protected]\n - [email protected]\n scope: function\n mbc:\n - Process::Terminate Process [C0018]\n examples:\n - C91887D861D9BD4A5872249B641BC9F9:0x401A77\n - 9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307\n features:\n - or:\n - api: System.Diagnostics.Process::Kill\n - api: System.Diagnostics.Process::WaitForExit\n - api: System.Diagnostics.Process::WaitForExitAsync\n - and:\n - optional:\n - match: open process\n - or:\n - api: kernel32.TerminateProcess\n - api: ntdll.NtTerminateProcess\n - api: kernel32.ExitProcess\n",
"format": "SIG_FORMAT_CAPA",
"description": "host-interaction/process/terminate",
"name": "terminate process",
"authors": [
"[email protected]",
"[email protected]",
"[email protected]"
]
},
{
"rule_src": "rule:\n meta:\n name: link function at runtime on Windows\n namespace: linking/runtime-linking\n authors:\n - [email protected]\n scope: function\n att&ck:\n - Execution::Shared Modules [T1129]\n examples:\n - 9324D1A8AE37A36AE560C37448C9705A:0x404130\n - Practical Malware Analysis Lab 01-04.exe_:0x401350\n features:\n - and:\n - os: windows\n - or:\n - api: kernel32.LoadLibrary\n - api: kernel32.GetModuleHandle\n - api: kernel32.GetModuleHandleEx\n - api: ntdll.LdrLoadDll\n - or:\n - api: kernel32.GetProcAddress\n - api: ntdll.LdrGetProcedureAddress\n - optional:\n - characteristic: indirect call\n",
"format": "SIG_FORMAT_CAPA",
"description": "linking/runtime-linking",
"name": "link function at runtime on Windows",
"authors": [
"[email protected]"
]
},
{
"rule_src": "rule:\n meta:\n name: packed with UPX\n namespace: anti-analysis/packer/upx\n authors:\n - [email protected]\n scope: file\n att&ck:\n - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002]\n mbc:\n - Anti-Static Analysis::Software Packing::UPX [F0001.008]\n examples:\n - CD2CBA9E6313E8DF2C1273593E649682\n - Practical Malware Analysis Lab 01-02.exe_:0x0401000\n features:\n - or:\n - and:\n - format: pe\n - or:\n - section: UPX0\n - section: UPX1\n - and:\n - format: elf\n - or:\n - string: \"UPX!\"\n",
"format": "SIG_FORMAT_CAPA",
"description": "anti-analysis/packer/upx",
"name": "packed with UPX",
"authors": [
"[email protected]"
]
},
{
"rule_src": "rule:\n meta:\n name: contain a resource (.rsrc) section\n namespace: executable/pe/section/rsrc\n authors:\n - [email protected]\n scope: file\n examples:\n - A933A1A402775CFA94B6BEE0963F4B46:0x41fd25\n features:\n - section: .rsrc\n",
"format": "SIG_FORMAT_CAPA",
"description": "executable/pe/section/rsrc",
"name": "contain a resource (.rsrc) section",
"authors": [
"[email protected]"
]
},
{
"rule_src": "rule:\n meta:\n name: (internal) packer file limitation\n namespace: internal/limitation/file\n authors:\n - [email protected]\n description: |\n This sample appears to be packed.\n\n Packed samples have often been obfuscated to hide their logic.\n capa cannot handle obfuscation well. This means the results may be misleading or incomplete.\n If possible, you should try to unpack this input file before analyzing it with capa.\n scope: file\n examples:\n - CD2CBA9E6313E8DF2C1273593E649682\n features:\n - or:\n - match: anti-analysis/packer\n",
"format": "SIG_FORMAT_CAPA",
"description": "This sample appears to be packed.\n\nPacked samples have often been obfuscated to hide their logic.\ncapa cannot handle obfuscation well. This means the results may be misleading or incomplete.\nIf possible, you should try to unpack this input file before analyzing it with capa.\n",
"name": "(internal) packer file limitation",
"authors": [
"[email protected]"
]
}
],
"last_modification_date": 1676671463,
"has_memdump": false
},
"type": "file_behaviour",
"id": "edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_CAPA",
"links": {
"self": "https://www.virustotal.com/api/v3/file_behaviours/edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_CAPA"
}
},
{
"attributes": {
"command_executions": [
"\"%SAMPLEPATH%\\setup-x86_64.exe\" ",
"\"%SAMPLEPATH%\\edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e.exe\" ",
"C:\\Windows\\System32\\wuapihost.exe -Embedding",
"\"%SAMPLEPATH%\\file.exe\" "
],
"ip_traffic": [
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:e5c0:7cff:e5c0:7cff:e5c0:7cff",
"destination_port": 53
},
{
"transport_layer_protocol": "TCP",
"destination_ip": "23.216.147.76",
"destination_port": 443
},
{
"transport_layer_protocol": "TCP",
"destination_ip": "20.99.133.109",
"destination_port": 443
},
{
"transport_layer_protocol": "TCP",
"destination_ip": "23.216.147.64",
"destination_port": 443
},
{
"transport_layer_protocol": "TCP",
"destination_ip": "20.99.184.37",
"destination_port": 443
},
{
"transport_layer_protocol": "TCP",
"destination_ip": "13.107.4.50",
"destination_port": 80
},
{
"transport_layer_protocol": "TCP",
"destination_ip": "104.86.182.43",
"destination_port": 443
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:0:0:100:0:1800:0",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:2c02:0:0:0:0:0",
"destination_port": 53
},
{
"transport_layer_protocol": "TCP",
"destination_ip": "23.35.98.25",
"destination_port": 443
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:1a1a:1aff:1a1a:1aff:1a1a:1aff",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:0:0:1400:1400:2800:3800",
"destination_port": 53
},
{
"transport_layer_protocol": "TCP",
"destination_ip": "23.40.197.184",
"destination_port": 443
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:8d00:100:89:9598:0:8b",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "192.168.0.14",
"destination_port": 137
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:2800:0:2800:0:1800:0",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:6219:d901:71a4:4e8e:6219:d901",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:4c00:5300:4900:2000:4500:6d00",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:6c00:6c00:2c00:2d00:3300:3600",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:2800:1800:4000:1800:1800:100",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:100:300:4170:7058:3677:366e",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:4600:6900:7200:6500:7700:6100",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "a83f:8110:3e05:0:0:0:3e05:0",
"destination_port": 53
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "192.168.0.19",
"destination_port": 137
},
{
"transport_layer_protocol": "UDP",
"destination_ip": "192.168.0.1",
"destination_port": 137
}
],
"processes_injected": [
"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
],
"processes_tree": [
{
"process_id": "2888",
"name": "%WINDIR%\\explorer.exe",
"children": [
{
"process_id": "3532",
"name": "%SAMPLEPATH%\\setup-x86_64.exe"
}
]
}
],
"has_pcap": false,
"analysis_date": 1669405151,
"sandbox_name": "Microsoft Sysinternals",
"has_html_report": false,
"processes_terminated": [
"C:\\Windows\\System32\\wuapihost.exe"
],
"behash": "5e435041f7d5d1981aa0a0d9419bcd97",
"files_deleted": [
"C:\\Windows\\System32\\spp\\store\\2.0\\cache\\cache.dat",
],
"files_dropped": [
],
"has_evtx": false,
"last_modification_date": 1677046497,
"has_memdump": false,
"processes_created": [
"%SAMPLEPATH%\\setup-x86_64.exe",
"%SAMPLEPATH%\\edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e.exe",
"C:\\Windows\\System32\\wuapihost.exe",
"%SAMPLEPATH%\\file.exe"
],
"modules_loaded": [
"%SAMPLEPATH%\\edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e.exe",
"%SAMPLEPATH%\\file.exe"
]
},
"type": "file_behaviour",
"id": "edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_Microsoft Sysinternals",
"links": {
"self": "https://www.virustotal.com/api/v3/file_behaviours/edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_Microsoft Sysinternals"
}
},
{
"attributes": {
"registry_keys_opened": [
"HKLM\\Software\\Cygwin\\setup",
"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0",
"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Arial",
"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
],
"calls_highlighted": [
"GetTickCount"
],
"tags": [
"DIRECT_CPU_CLOCK_ACCESS",
"RUNTIME_MODULES"
],
"has_pcap": false,
"analysis_date": 1669405225,
"sandbox_name": "VirusTotal Jujubox",
"has_html_report": true,
"behash": "2563a14030568b9376fcc24af405d1c8",
"has_evtx": false,
"text_highlighted": [
"Cygwin Setup",
"Cygwin Net Release Setup Program",
"This setup program is used for the initial installation of the Cygwin environment as well as all subsequent updates. The pages that follow will guide you through the installation.\n\nPlease note that we",
"Setup version 2.924 (64 bit)",
"Copyright 2000-2022",
"https://cygwin.com",
"Finish",
"Help"
],
"services_opened": [
"AvSynMgr"
],
"last_modification_date": 1669405226,
"has_memdump": false,
"modules_loaded": [
"KERNEL32.DLL",
"ADVAPI32.dll",
"COMCTL32.dll",
"GDI32.dll",
"msvcrt.dll",
"ntdll.dll",
"ole32.dll",
"PSAPI.DLL",
"SHELL32.dll",
"SHLWAPI.dll",
"USER32.dll",
"WININET.dll",
"WS2_32.dll",
"C:\\Windows\\system32\\tzres.dll",
"CRYPTBASE.dll",
"CLBCatQ.DLL",
"C:\\Windows\\system32\\shell32.dll",
"UxTheme.dll",
"IMM32.dll",
"C:\\Windows\\system32\\ole32.dll"
],
"files_opened": [
"/etc\\system-fips",
"C:\\Windows\\system32\\tzres.dll",
"C:\\Users\\<USER>\\Downloads\\setup.rc",
"C:\\cygwin64\\etc\\setup\\setup.rc",
"C:\\Windows\\system32\\rpcss.dll",
"C:\\Windows\\WinSxS\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3",
"C:\\Windows\\WinSxS\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\COMCTL32.dll.mui",
"C:\\Windows\\system32\\en-US\\USER32.dll.mui",
"C:\\Windows\\system32\\UxTheme.dll",
"C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_e372d88f30fbb845",
"C:\\Windows\\Fonts\\staticcache.dat"
]
},
"type": "file_behaviour",
"id": "edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_VirusTotal Jujubox",
"links": {
"self": "https://www.virustotal.com/api/v3/file_behaviours/edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_VirusTotal Jujubox"
}
},
{
"attributes": {
"signature_matches": [
{
"id": "825",
"match_data": [
"More than 3 window changes detected"
],
"description": "Found graphical window changes (likely an installer)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "418",
"match_data": [
"File size 1381395 > 1048576"
],
"description": "Submission file is bigger than most known malware samples",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "509",
"refs": [
{
"ref": "#registry_keys_opened",
"value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers"
}
],
"match_data": [
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers"
],
"description": "Reads software policies",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "342",
"match_data": [
"section name: UPX0",
"section name: UPX1"
],
"description": "Sample is packed with UPX",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "767",
"match_data": [
"Next >"
],
"description": "Found GUI installer (many successful clicks)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "206",
"refs": [
{
"ref": "#dns_lookups",
"value": "queries for: cygwin.com"
}
],
"match_data": [
"queries for: cygwin.com"
],
"description": "Performs DNS lookups",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "715",
"match_data": [
"clean0.winEXE@1/1@1/1"
],
"description": "Classification label",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "625",
"match_data": [
"HTTP traffic on port 49736 -> 443",
"HTTP traffic on port 443 -> 49736"
],
"description": "Uses HTTPS",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "624",
"description": "Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "513",
"match_data": [
"window name: SysTabControl32"
],
"description": "Executable creates window controls seldom found in malware",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "507",
"match_data": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\InProcServer32"
],
"description": "Uses an in-process (OLE) Automation server",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "263",
"refs": [
{
"ref": "#memory_dumps",
"value": "program.exe, 00000000.00000002.4727768602.00000000001B5000.00000004.00000020.00020000.00000000.sdmp"
},
{
"ref": "#memory_dumps",
"value": "program.exe, 00000000.00000002.4727292270.0000000000168000.00000004.00000020.00020000.00000000.sdmp"
}
],
"match_data": [
"Hyper-V RAW",
"Hyper-V RAW "
],
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "328",
"match_data": [
"C:\\Windows\\System32\\drivers\\etc\\hosts"
],
"description": "Reads the hosts file",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "768",
"match_data": [
"Number of UI elements: 16",
"Number of UI elements: 19",
"Number of UI elements: 25",
"Number of UI elements: 28",
"Number of UI elements: 30"
],
"description": "Found window with many clickable UI elements (buttons, textforms, scrollbars etc)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "433",
"match_data": [
"Section: UPX1 ZLIB complexity 0.9993296606864275"
],
"description": "PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "238",
"match_data": [
"ftp://cygwin.osuosl.org",
"ftp://ftp-stud.hs-esslingen.de/pub/Mirrors/sources.redhat.com/cygwin/https://l",
"ftp://ftp.byfly.by",
"ftp://ftp.eq.uc.pt",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://mc.",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://mw",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/https://ftj",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/or",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/r",
"ftp://ftp.fau.de/cygwin/",
"ftp://ftp.fau.desl.orgor",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/",
"ftp://ftp.ha",
"ftp://ftp.halifax.rwth-aachen.de/cygwin/.net/",
"ftp://ftp.halifax.rwth-aachen.dehttps:/",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://cyG",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://f",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://l",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://s",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://9",
"ftp://ftp.iij.ad.jp/pub/cygwin/n/",
"ftp://ftp.iij.ad.jp/pub/cygwin/or",
"ftp://ftp.inf.tu-dresden.dehttps://",
"ftp://ftp.inf.tu-dresden.deor",
"ftp://ftp.jaist.ac.jp/pub/cygwin/",
"ftp://ftp.jaist.ac.jpt",
"ftp://ftp.kaist.ac.kr/cygwin/",
"ftp://ftp.kaist.ac.kr/cygwin/https://",
"ftp://ftp.kaist.ac.kr/cygwin/p",
"ftp://ftp.kaist.ac.kr/cygwin/site",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://c",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://fK)t",
"ftp://ftp.l",
"ftp://ftp.l(-Z",
"ftp://ftp.lf1",
"ftp://ftp.lip6.fr/pub/cygwin/",
"ftp://ftp.lip6.fr/pub/cygwin/rror",
"ftp://ftp.mirrorservice.orghttp://mirro",
"ftp://ftp.mirrorservice.orgn",
"ftp://ftp.mirrorservice.orgygwin/",
"ftp://ftp.mm",
"ftp://ftp.muug.ca",
"ftp://ftp.muug.ca/mirror/cygwin/",
"ftp://ftp.n",
"ftp://ftp.ntu.edu.tw/pub/cygwin/s",
"ftp://ftp.rnl.tecnico.ulisboa.pt/pub/cygwin/irror",
"ftp://ftp.snt.utwente.nl/pub/software/cygwin/",
"ftp://ftp.snt.utwente.nlftp",
"ftp://ftp.snt.utwente.nltp",
"ftp://ftp.yz.yamagata-u.ac.jp",
"ftp://ftp.yz.yamagata-u.ac.jphttps://ft",
"ftp://linux.rz.ruhr-uni-bochum.de",
"ftp://linux.rz.ruhr-uni-bochum.dehttp:/Z/",
"ftp://mirror.cs.vt.edu/pub/cygwin/cygwin/gwin",
"ftp://mirror.csclub.uwaterloo.ca/cygwin/ygwin",
"ftp://mirror.internode.on.net/pub/cygwin/gwin",
"ftp://mirror.internode.on.net/pub/cygwin/http",
"ftp://mirror.lagoon.nc",
"ftp://mirror.lagoon.nc/cygwin/",
"ftp://mirror.lagoon.nc/cygwin/.ca",
"ftp://mirror.lagoon.nc/cygwin/https://",
"ftp://mirror.lagoon.nc/cygwin/https://c:34",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/p",
"ftp://mirrors.netix.net/cygwin/http://f",
"ftp://mirrors.netix.net/cygwin/http://w",
"ftp://mirrors.sonic.net/cygwin/http://f",
"ftp://mirrors.sonic.net/cygwin/https://9",
"ftp://mirrors.xmission.com/cygwin/",
"ftp://mirrors.xmission.comwin",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://f",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/nt",
"http://ac.economia.gob.mx/cps.html0",
"http://ac.economia.gob.mx/last.crl0G",
"http://acedicom.edicomgroup.com/doc0",
"http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?",
"http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0",
"http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://ca.disig.sk/ca/crl/ca_disig.crl0",
"http://ca.mtin.es/mtin/DPCyPoliticas0",
"http://ca.mtin.es/mtin/DPCyPoliticas0g",
"http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03",
"http://ca.mtin.es/mtin/ocsp0",
"http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0",
"http://certificates.starfieldtech.com/repository/1604",
"http://certs.oati.net/repository/OATICA2.crl0",
"http://certs.oati.net/repository/OATICA2.crt0",
"http://certs.oaticerts.com/repository/OATICA2.crl",
"http://certs.oaticerts.com/repository/OATICA2.crt08",
"http://cps.chambersign.org/cps/chambersignroot.html0",
"http://cps.chambersign.org/cps/chambersroot.html0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://cps.siths.se/sithsrootcav1.html0",
"http://crl.certigna.fr/certignarootca.crl01",
"http://crl.chambersign.org/chambersignroot.crl0",
"http://crl.chambersign.org/chambersroot.crl0",
"http://crl.comodoca.com/AAACertificateServices.crl06",
"http://crl.defence.gov.au/pki0",
"http://crl.dhimyotis.com/certignarootca.crl0",
"http://crl.globalsign.net/root-r2.crl0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://crl.oces.trust2408.com/oces.crl0",
"http://crl.securetrust.com/SGCA.crl0",
"http://crl.securetrust.com/STCA.crl0",
"http://crl.ssc.lt/root-a/cacrl.crl0",
"http://crl.ssc.lt/root-b/cacrl.crl0",
"http://crl.ssc.lt/root-c/cacrl.crl0",
"http://crl.xrampsecurity.com/XGCA.crl0",
"http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
"http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635",
"http://cygwin.cathedral-",
"http://cygwin.cathedral-10",
"http://cygwin.cathedral-N/",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org$",
"http://cygwin.cathedral-networks.org&",
"http://cygwin.cathedral-networks.org.noG3",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/)",
"http://cygwin.cathedral-networks.org/-u",
"http://cygwin.cathedral-networks.org/.",
"http://cygwin.cathedral-networks.org/.d",
"http://cygwin.cathedral-networks.org/.iK",
"http://cygwin.cathedral-networks.org/.n",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org//%M",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org///b",
"http://cygwin.cathedral-networks.org//5-",
"http://cygwin.cathedral-networks.org//I",
"http://cygwin.cathedral-networks.org//T",
"http://cygwin.cathedral-networks.org//U",
"http://cygwin.cathedral-networks.org//c",
"http://cygwin.cathedral-networks.org//f",
"http://cygwin.cathedral-networks.org//fB",
"http://cygwin.cathedral-networks.org//fQ",
"http://cygwin.cathedral-networks.org//l",
"http://cygwin.cathedral-networks.org/0",
"http://cygwin.cathedral-networks.org/1",
"http://cygwin.cathedral-networks.org/1-",
"http://cygwin.cathedral-networks.org/3)",
"http://cygwin.cathedral-networks.org/5",
"http://cygwin.cathedral-networks.org/7",
"http://cygwin.cathedral-networks.org/8",
"http://cygwin.cathedral-networks.org/:/l",
"http://cygwin.cathedral-networks.org/;34",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/=",
"http://cygwin.cathedral-networks.org/=M",
"http://cygwin.cathedral-networks.org/?/",
"http://cygwin.cathedral-networks.org/A",
"http://cygwin.cathedral-networks.org/D",
"http://cygwin.cathedral-networks.org/E3",
"http://cygwin.cathedral-networks.org/F(x",
"http://cygwin.cathedral-networks.org/J",
"http://cygwin.cathedral-networks.org/J(t",
"http://cygwin.cathedral-networks.org/L-",
"http://cygwin.cathedral-networks.org/Q.",
"http://cygwin.cathedral-networks.org/T3",
"http://cygwin.cathedral-networks.org/W8Z",
"http://cygwin.cathedral-networks.org/X",
"http://cygwin.cathedral-networks.org/Z",
"http://cygwin.cathedral-networks.org/_",
"http://cygwin.cathedral-networks.org/a3",
"http://cygwin.cathedral-networks.org/am",
"http://cygwin.cathedral-networks.org/au",
"http://cygwin.cathedral-networks.org/b/A3",
"http://cygwin.cathedral-networks.org/cy",
"http://cygwin.cathedral-networks.org/d",
"http://cygwin.cathedral-networks.org/de",
"http://cygwin.cathedral-networks.org/dh",
"http://cygwin.cathedral-networks.org/e8(",
"http://cygwin.cathedral-networks.org/et",
"http://cygwin.cathedral-networks.org/eta1",
"http://cygwin.cathedral-networks.org/ez",
"http://cygwin.cathedral-networks.org/fs",
"http://cygwin.cathedral-networks.org/ft",
"http://cygwin.cathedral-networks.org/ftP-",
"http://cygwin.cathedral-networks.org/ftp",
"http://cygwin.cathedral-networks.org/hk",
"http://cygwin.cathedral-networks.org/i",
"http://cygwin.cathedral-networks.org/i&e",
"http://cygwin.cathedral-networks.org/ia",
"http://cygwin.cathedral-networks.org/inF",
"http://cygwin.cathedral-networks.org/inG",
"http://cygwin.cathedral-networks.org/inm",
"http://cygwin.cathedral-networks.org/ir?",
"http://cygwin.cathedral-networks.org/k",
"http://cygwin.cathedral-networks.org/k.",
"http://cygwin.cathedral-networks.org/lf1",
"http://cygwin.cathedral-networks.org/lyT",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/m0",
"http://cygwin.cathedral-networks.org/n",
"http://cygwin.cathedral-networks.org/oB-f",
"http://cygwin.cathedral-networks.org/os",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/p.n",
"http://cygwin.cathedral-networks.org/p1",
"http://cygwin.cathedral-networks.org/p2",
"http://cygwin.cathedral-networks.org/q",
"http://cygwin.cathedral-networks.org/r.",
"http://cygwin.cathedral-networks.org/rgm",
"http://cygwin.cathedral-networks.org/rs",
"http://cygwin.cathedral-networks.org/s",
"http://cygwin.cathedral-networks.org/sI-",
"http://cygwin.cathedral-networks.org/ter.by",
"http://cygwin.cathedral-networks.org/th-aachen.derg9",
"http://cygwin.cathedral-networks.org/un",
"http://cygwin.cathedral-networks.org/us",
"http://cygwin.cathedral-networks.org/ux#",
"http://cygwin.cathedral-networks.org/x(j",
"http://cygwin.cathedral-networks.org/x.:(",
"http://cygwin.cathedral-networks.org/y",
"http://cygwin.cathedral-networks.org/yd2",
"http://cygwin.cathedral-networks.org/z(d",
"http://cygwin.cathedral-networks.org3.",
"http://cygwin.cathedral-networks.org5",
"http://cygwin.cathedral-networks.org:",
"http://cygwin.cathedral-networks.org://",
"http://cygwin.cathedral-networks.org://F2",
"http://cygwin.cathedral-networks.org://M",
"http://cygwin.cathedral-networks.orgF",
"http://cygwin.cathedral-networks.orgF-",
"http://cygwin.cathedral-networks.orgKonk",
"http://cygwin.cathedral-networks.orgP",
"http://cygwin.cathedral-networks.orga0",
"http://cygwin.cathedral-networks.orgala",
"http://cygwin.cathedral-networks.orgcew",
"http://cygwin.cathedral-networks.orgck",
"http://cygwin.cathedral-networks.orgcygX2",
"http://cygwin.cathedral-networks.orgetn/",
"http://cygwin.cathedral-networks.orgf",
"http://cygwin.cathedral-networks.orgf(X",
"http://cygwin.cathedral-networks.orgirr",
"http://cygwin.cathedral-networks.orgjp",
"http://cygwin.cathedral-networks.orgk",
"http://cygwin.cathedral-networks.orgkBS",
"http://cygwin.cathedral-networks.orglit",
"http://cygwin.cathedral-networks.orgn",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgn/:M",
"http://cygwin.cathedral-networks.orgn/qBi",
"http://cygwin.cathedral-networks.orgnf.=6P",
"http://cygwin.cathedral-networks.orgp.m",
"http://cygwin.cathedral-networks.orgp6",
"http://cygwin.cathedral-networks.orgr",
"http://cygwin.cathedral-networks.orgree",
"http://cygwin.cathedral-networks.orgror",
"http://cygwin.cathedral-networks.orgt",
"http://cygwin.cathedral-networks.orgta-I2",
"http://cygwin.cathedral-networks.orgto",
"http://cygwin.cathedral-networks.orgu.",
"http://cygwin.cathedral-networks.orgv1",
"http://cygwin.cathedral-networks.orgv3",
"http://cygwin.cathedral-networks.orgw",
"http://cygwin.mbwarez",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk#",
"http://cygwin.mbwarez.dk(",
"http://cygwin.mbwarez.dk)",
"http://cygwin.mbwarez.dk-bochum.dea.A",
"http://cygwin.mbwarez.dk-bochum.dee;&",
"http://cygwin.mbwarez.dk-bochum.dein/s",
"http://cygwin.mbwarez.dk.acc.umu.se/miri",
"http://cygwin.mbwarez.dk.aun/",
"http://cygwin.mbwarez.dk.auwin/",
"http://cygwin.mbwarez.dk.by/pub/mirrors",
"http://cygwin.mbwarez.dk.byom/cygwin/",
"http://cygwin.mbwarez.dk.de/cygwin/n/",
"http://cygwin.mbwarez.dk.iij.ad.jp",
"http://cygwin.mbwarez.dk.net/edu.cn",
"http://cygwin.mbwarez.dk.org/mirrors/cy",
"http://cygwin.mbwarez.dk.orgso.netsl.1",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/#f",
"http://cygwin.mbwarez.dk/$",
"http://cygwin.mbwarez.dk/.ac.nz.tw/pub",
"http://cygwin.mbwarez.dk/.ac.nzn/",
"http://cygwin.mbwarez.dk/.c",
"http://cygwin.mbwarez.dk/.cathedral-S3",
"http://cygwin.mbwarez.dk/.cn/cygwin/1",
"http://cygwin.mbwarez.dk/.de/pub/Mirrors/sources.redhat.com/cygwin/",
"http://cygwin.mbwarez.dk/.deode.on.netd",
"http://cygwin.mbwarez.dk/.iij.ad.jp",
"http://cygwin.mbwarez.dk/.jpcygwin/",
"http://cygwin.mbwarez.dk/.lip6.frde/mm",
"http://cygwin.mbwarez.dk/.net",
"http://cygwin.mbwarez.dk/.netet23",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk//.cagwin/d.",
"http://cygwin.mbwarez.dk///mirror.isoc.",
"http://cygwin.mbwarez.dk//MoldovasA",
"http://cygwin.mbwarez.dk//cygw",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin/(/",
"http://cygwin.mbwarez.dk//cygwin//",
"http://cygwin.mbwarez.dk//cygwin///",
"http://cygwin.mbwarez.dk//cygwin/l.",
"http://cygwin.mbwarez.dk//cygwin/la",
"http://cygwin.mbwarez.dk//cygwin/n/",
"http://cygwin.mbwarez.dk//cygwin/nnk",
"http://cygwin.mbwarez.dk//cygwin/or",
"http://cygwin.mbwarez.dk//cygwin/rors.r",
"http://cygwin.mbwarez.dk//cygwin/t1l",
"http://cygwin.mbwarez.dk//gwin/.de",
"http://cygwin.mbwarez.dk//in//u",
"http://cygwin.mbwarez.dk//pub/cygwin/",
"http://cygwin.mbwarez.dk//win//m",
"http://cygwin.mbwarez.dk//win/2-",
"http://cygwin.mbwarez.dk//win/n/",
"http://cygwin.mbwarez.dk/0",
"http://cygwin.mbwarez.dk/1%",
"http://cygwin.mbwarez.dk/1K",
"http://cygwin.mbwarez.dk/://ftp.kr.free",
"http://cygwin.mbwarez.dk/://mirrors.ust)",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/Australi",
"http://cygwin.mbwarez.dk/Chinas.7/",
"http://cygwin.mbwarez.dk/E",
"http://cygwin.mbwarez.dk/Europek",
"http://cygwin.mbwarez.dk/I0",
"http://cygwin.mbwarez.dk/P",
"http://cygwin.mbwarez.dk/Q",
"http://cygwin.mbwarez.dk/a",
"http://cygwin.mbwarez.dk/alasiaB",
"http://cygwin.mbwarez.dk/au.dergmq",
"http://cygwin.mbwarez.dk/auin//d.org;(",
"http://cygwin.mbwarez.dk/by.ptK3",
"http://cygwin.mbwarez.dk/byfly.by/pub/c",
"http://cygwin.mbwarez.dk/c.jp",
"http://cygwin.mbwarez.dk/ca.de",
"http://cygwin.mbwarez.dk/chum.den///",
"http://cygwin.mbwarez.dk/ckdomain.de",
"http://cygwin.mbwarez.dk/comrrahostr3",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin/.de",
"http://cygwin.mbwarez.dk/cygwin//",
"http://cygwin.mbwarez.dk/cygwin///",
"http://cygwin.mbwarez.dk/cygwin//in/w&",
"http://cygwin.mbwarez.dk/cygwin/in//F",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/n/qI%",
"http://cygwin.mbwarez.dk/cygwin/n/v",
"http://cygwin.mbwarez.dk/cygwin/net/t",
"http://cygwin.mbwarez.dk/cygwin/ware.o:",
"http://cygwin.mbwarez.dk/cygwin/win/",
"http://cygwin.mbwarez.dk/cygwin32/",
"http://cygwin.mbwarez.dk/d",
"http://cygwin.mbwarez.dk/ddos.net/cygwilZ",
"http://cygwin.mbwarez.dk/de",
"http://cygwin.mbwarez.dk/de/cygwin/",
"http://cygwin.mbwarez.dk/de/cygwin//",
"http://cygwin.mbwarez.dk/degwin//",
"http://cygwin.mbwarez.dk/e",
"http://cygwin.mbwarez.dk/e/cygw",
"http://cygwin.mbwarez.dk/ei",
"http://cygwin.mbwarez.dk/en.de",
"http://cygwin.mbwarez.dk/en.de(",
"http://cygwin.mbwarez.dk/en.de.byom",
"http://cygwin.mbwarez.dk/et/cygwin/",
"http://cygwin.mbwarez.dk/et/cygwin/p0",
"http://cygwin.mbwarez.dk/etcom",
"http://cygwin.mbwarez.dk/ewin/LIH",
"http://cygwin.mbwarez.dk/eworks.orgq-",
"http://cygwin.mbwarez.dk/fau.dejp",
"http://cygwin.mbwarez.dk/ft.edu.cn/c",
"http://cygwin.mbwarez.dk/g/cygwin/",
"http://cygwin.mbwarez.dk/g/cygwin/0K",
"http://cygwin.mbwarez.dk/gata-u",
"http://cygwin.mbwarez.dk/gen.de/",
"http://cygwin.mbwarez.dk/gen.de/n/ooN.v",
"http://cygwin.mbwarez.dk/gorks.org/",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin/.free",
"http://cygwin.mbwarez.dk/gwin//",
"http://cygwin.mbwarez.dk/gwin//.i",
"http://cygwin.mbwarez.dk/gwin//gwin/",
"http://cygwin.mbwarez.dk/gwin//heY",
"http://cygwin.mbwarez.dk/gwin/c.krf3",
"http://cygwin.mbwarez.dk/gwin/in/",
"http://cygwin.mbwarez.dk/gwin/in/n",
"http://cygwin.mbwarez.dk/gwin/na9-",
"http://cygwin.mbwarez.dk/gwin/ygwin/",
"http://cygwin.mbwarez.dk/hen.de.org/",
"http://cygwin.mbwarez.dk/hen.de/cygwin/",
"http://cygwin.mbwarez.dk/https://q",
"http://cygwin.mbwarez.dk/iij.ad.jp/pub/",
"http://cygwin.mbwarez.dk/in.osuosl.org",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in////",
"http://cygwin.mbwarez.dk/in//://li"
],
"description": "URLs found in memory or binary data",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "90",
"match_data": [
"C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\R0IAZP7Z\\mirrors[1].lst"
],
"description": "Creates files inside the user directory",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "7058",
"match_data": [
"8.43.85.97:443 -> 192.168.2.11:49736 version: TLS 1.2"
],
"description": "Uses secure TLS version for HTTPS connections",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "410",
"match_data": [
"Raw size of UPX1 is bigger than: 0x100000 < 0x140800"
],
"description": "PE file has a big raw section",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"description": "Uses HTTPS",
"match_data": [
"HTTP traffic on port 49714 -> 443",
"HTTP traffic on port 443 -> 49714"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "625"
},
{
"refs": [
{
"ref": "#memory_dumps",
"value": "executable.exe, 00000000.00000002.4737795738.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp"
}
],
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)",
"match_data": [
"Hyper-V RAW"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "263"
},
{
"description": "URLs found in memory or binary data",
"match_data": [
"ftp://ftp-stud.hs-esslingen.dehttp://f",
"ftp://ftp-stud.hs-esslingen.dehttps://f",
"ftp://ftp.#",
"ftp://ftp.byfly.by/pub/cygwin/https://",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://l",
"ftp://ftp.fau.de/cygwin/os",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/.com/http://m)",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/p",
"ftp://ftp.halifax.rwth-aachen.der",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.inf.tu-dresden.deor",
"ftp://ftp.jaist.ac.jp/pub/cygwin/",
"ftp://ftp.kaist.ac.kr/cygwin/ar",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://mX",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://L",
"ftp://ftp.l",
"ftp://ftp.lip6.fr",
"ftp://ftp.lip6.fr/pub/cygwin/",
"ftp://ftp.lip6.fr/pub/cygwin/http://ftp",
"ftp://ftp.muug.ca/mirror/cygwin/yhttps://",
"ftp://ftp.ntu.edu.tw/pub/cygwin/",
"ftp://ftp.ntua.gr/pub/pc/cygwin/http://",
"ftp://ftp.ntua.gr/pub/pc/cygwin/yhttps://",
"ftp://ftp.snt.utwente.nl/pub/software/cygwin/",
"ftp://ftp.snt.utwente.nl/pub/software/cygwin/ite",
"ftp://ftp.snt.utwente.nle",
"ftp://ftp.snt.utwente.nlhttps://",
"ftp://ftp.yz.yamagata-u.ac.jp/p",
"ftp://ftp.yz.yamagata-u.ac.jp/pF",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin//B",
"ftp://mirror.checkdomain.de/cygwin/http://f",
"ftp://mirror.csclub.uwaterloo.can",
"ftp://mirror.datacenter.by/pub/mirrors/cygwin/https://",
"ftp://mirror.easyname.at.ac.jphttp://f",
"ftp://mirror.easyname.attp",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/https://",
"ftp://mirrors.dotsrc.orgewin",
"ftp://mirrors.netix.net/cygwin/",
"ftp://mirrors.netix.net/cygwin/r",
"ftp://mirrors.syringanetworks.net/cygwin/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://m",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://mz-",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/https://",
"ftp://sunsite.icm.edu.plygwin",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://cygwin.cathedral-",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org#",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/-",
"http://cygwin.cathedral-networks.org/.",
"http://cygwin.cathedral-networks.org/.fh",
"http://cygwin.cathedral-networks.org/.i",
"http://cygwin.cathedral-networks.org/.n",
"http://cygwin.cathedral-networks.org/.n/",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org//A",
"http://cygwin.cathedral-networks.org//A-",
"http://cygwin.cathedral-networks.org//a",
"http://cygwin.cathedral-networks.org//f",
"http://cygwin.cathedral-networks.org//l",
"http://cygwin.cathedral-networks.org//wX",
"http://cygwin.cathedral-networks.org/6",
"http://cygwin.cathedral-networks.org/;;",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/?",
"http://cygwin.cathedral-networks.org/B",
"http://cygwin.cathedral-networks.org/C-",
"http://cygwin.cathedral-networks.org/H",
"http://cygwin.cathedral-networks.org/L",
"http://cygwin.cathedral-networks.org/L4-1&",
"http://cygwin.cathedral-networks.org/R",
"http://cygwin.cathedral-networks.org/U",
"http://cygwin.cathedral-networks.org/Z",
"http://cygwin.cathedral-networks.org/_",
"http://cygwin.cathedral-networks.org/a",
"http://cygwin.cathedral-networks.org/ce",
"http://cygwin.cathedral-networks.org/cy",
"http://cygwin.cathedral-networks.org/d",
"http://cygwin.cathedral-networks.org/e.",
"http://cygwin.cathedral-networks.org/ec",
"http://cygwin.cathedral-networks.org/ez",
"http://cygwin.cathedral-networks.org/e~",
"http://cygwin.cathedral-networks.org/fr",
"http://cygwin.cathedral-networks.org/ft",
"http://cygwin.cathedral-networks.org/gq;",
"http://cygwin.cathedral-networks.org/h",
"http://cygwin.cathedral-networks.org/i",
"http://cygwin.cathedral-networks.org/in4.",
"http://cygwin.cathedral-networks.org/l",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/n/L",
"http://cygwin.cathedral-networks.org/om",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/p.",
"http://cygwin.cathedral-networks.org/pux",
"http://cygwin.cathedral-networks.org/r",
"http://cygwin.cathedral-networks.org/r/",
"http://cygwin.cathedral-networks.org/ro",
"http://cygwin.cathedral-networks.org/s",
"http://cygwin.cathedral-networks.org/s.",
"http://cygwin.cathedral-networks.org/sdD/",
"http://cygwin.cathedral-networks.org/t",
"http://cygwin.cathedral-networks.org/th",
"http://cygwin.cathedral-networks.org/u.",
"http://cygwin.cathedral-networks.org/v",
"http://cygwin.cathedral-networks.org/wne",
"http://cygwin.cathedral-networks.org/x",
"http://cygwin.cathedral-networks.org/yn",
"http://cygwin.cathedral-networks.org4-",
"http://cygwin.cathedral-networks.org9",
"http://cygwin.cathedral-networks.org://",
"http://cygwin.cathedral-networks.orgB",
"http://cygwin.cathedral-networks.orgG",
"http://cygwin.cathedral-networks.orgM",
"http://cygwin.cathedral-networks.orgX",
"http://cygwin.cathedral-networks.orgY",
"http://cygwin.cathedral-networks.orgZ",
"http://cygwin.cathedral-networks.orga",
"http://cygwin.cathedral-networks.orgdot",
"http://cygwin.cathedral-networks.orge=",
"http://cygwin.cathedral-networks.orgen",
"http://cygwin.cathedral-networks.orgh",
"http://cygwin.cathedral-networks.orgin/L",
"http://cygwin.cathedral-networks.orgj",
"http://cygwin.cathedral-networks.orgjp",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgn/W",
"http://cygwin.cathedral-networks.orgn/c",
"http://cygwin.cathedral-networks.orgni-",
"http://cygwin.cathedral-networks.orgors",
"http://cygwin.cathedral-networks.orgp",
"http://cygwin.cathedral-networks.orgrs.",
"http://cygwin.cathedral-networks.orgstc",
"http://cygwin.cathedral-networks.orgtp",
"http://cygwin.cathedral-networks.orgv",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk#",
"http://cygwin.mbwarez.dk$",
"http://cygwin.mbwarez.dk.dewin/et/X411",
"http://cygwin.mbwarez.dk.net",
"http://cygwin.mbwarez.dk.net/",
"http://cygwin.mbwarez.dk.org",
"http://cygwin.mbwarez.dk.orgwin//",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/$w",
"http://cygwin.mbwarez.dk/%",
"http://cygwin.mbwarez.dk/(",
"http://cygwin.mbwarez.dk/.ca/om/q",
"http://cygwin.mbwarez.dk/.cn/cygwin/n",
"http://cygwin.mbwarez.dk/.jp",
"http://cygwin.mbwarez.dk/.org.ilt",
"http://cygwin.mbwarez.dk/.twaren.net/Un",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk///cygwin/",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin/.c",
"http://cygwin.mbwarez.dk//cygwin//a",
"http://cygwin.mbwarez.dk//cygwin/:",
"http://cygwin.mbwarez.dk//cygwin/F",
"http://cygwin.mbwarez.dk//cygwin/V",
"http://cygwin.mbwarez.dk//cygwin/g",
"http://cygwin.mbwarez.dk//cygwin/h(&1",
"http://cygwin.mbwarez.dk//cygwin/win/",
"http://cygwin.mbwarez.dk//gwin/n/",
"http://cygwin.mbwarez.dk//in/",
"http://cygwin.mbwarez.dk//win//",
"http://cygwin.mbwarez.dk//ygwin/dG",
"http://cygwin.mbwarez.dk/0",
"http://cygwin.mbwarez.dk/9",
"http://cygwin.mbwarez.dk/:1r.",
"http://cygwin.mbwarez.dk/;",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/B",
"http://cygwin.mbwarez.dk/Bulgaria",
"http://cygwin.mbwarez.dk/China",
"http://cygwin.mbwarez.dk/China/d:",
"http://cygwin.mbwarez.dk/Europek",
"http://cygwin.mbwarez.dk/I",
"http://cygwin.mbwarez.dk/X",
"http://cygwin.mbwarez.dk/argasso.net",
"http://cygwin.mbwarez.dk/chum.de",
"http://cygwin.mbwarez.dk/chum.degwin/",
"http://cygwin.mbwarez.dk/cn/cygwin/j",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin/)",
"http://cygwin.mbwarez.dk/cygwin/.ucalg$",
"http://cygwin.mbwarez.dk/cygwin//c",
"http://cygwin.mbwarez.dk/cygwin//in/",
"http://cygwin.mbwarez.dk/cygwin/1",
"http://cygwin.mbwarez.dk/cygwin/X",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/z",
"http://cygwin.mbwarez.dk/cygwin32/7",
"http://cygwin.mbwarez.dk/cygwin32/V",
"http://cygwin.mbwarez.dk/cygwin32/b",
"http://cygwin.mbwarez.dk/d.com",
"http://cygwin.mbwarez.dk/d.com/cygwin/",
"http://cygwin.mbwarez.dk/de/cygwin/",
"http://cygwin.mbwarez.dk/dehttp://f",
"http://cygwin.mbwarez.dk/deurces.redha=",
"http://cygwin.mbwarez.dk/e",
"http://cygwin.mbwarez.dk/e=",
"http://cygwin.mbwarez.dk/earia",
"http://cygwin.mbwarez.dk/ecygwin/",
"http://cygwin.mbwarez.dk/edu.sg/mirror/",
"http://cygwin.mbwarez.dk/ein/://ft",
"http://cygwin.mbwarez.dk/ernode.on.netE",
"http://cygwin.mbwarez.dk/et/cygwin/x5",
"http://cygwin.mbwarez.dk/etworks.org",
"http://cygwin.mbwarez.dk/etworks.org/U",
"http://cygwin.mbwarez.dk/etygwin/(5",
"http://cygwin.mbwarez.dk/f",
"http://cygwin.mbwarez.dk/f1p",
"http://cygwin.mbwarez.dk/g$",
"http://cygwin.mbwarez.dk/g/cygwin/",
"http://cygwin.mbwarez.dk/gwin.uib.no/",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin//n/;",
"http://cygwin.mbwarez.dk/gwin/n//",
"http://cygwin.mbwarez.dk/gwin/n/fa-",
"http://cygwin.mbwarez.dk/gwin/win/",
"http://cygwin.mbwarez.dk/ia",
"http://cygwin.mbwarez.dk/iajaist.ac.jp",
"http://cygwin.mbwarez.dk/iar.freebsd.oa",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in//",
"http://cygwin.mbwarez.dk/in///;",
"http://cygwin.mbwarez.dk/in//n//",
"http://cygwin.mbwarez.dk/in/in/2",
"http://cygwin.mbwarez.dk/in/l.ca/",
"http://cygwin.mbwarez.dk/in/n/",
"http://cygwin.mbwarez.dk/in/nus.edu?.f1",
"http://cygwin.mbwarez.dk/in/tp.kr.fK",
"http://cygwin.mbwarez.dk/in/ttp://c&",
"http://cygwin.mbwarez.dk/in/x",
"http://cygwin.mbwarez.dk/in/ygwin/",
"http://cygwin.mbwarez.dk/inf.tu-dresden0",
"http://cygwin.mbwarez.dk/l1",
"http://cygwin.mbwarez.dk/mirror.e",
"http://cygwin.mbwarez.dk/n/",
"http://cygwin.mbwarez.dk/n///x",
"http://cygwin.mbwarez.dk/n/cygwin/",
"http://cygwin.mbwarez.dk/n/n/",
"http://cygwin.mbwarez.dk/n/n/in/",
"http://cygwin.mbwarez.dk/n/win/",
"http://cygwin.mbwarez.dk/netgwin/",
"http://cygwin.mbwarez.dk/om/cygwin/",
"http://cygwin.mbwarez.dk/om/cygwin/O",
"http://cygwin.mbwarez.dk/om/cygwin/n/q",
"http://cygwin.mbwarez.dk/or.rafal.ca",
"http://cygwin.mbwarez.dk/orgitceware.9-",
"http://cygwin.mbwarez.dk/p",
"http://cygwin.mbwarez.dk/p://mirror-hk.",
"http://cygwin.mbwarez.dk/ps://mirrors.huaweicloud.com/cygwin/",
"http://cygwin.mbwarez.dk/r.lagoon.ncp",
"http://cygwin.mbwarez.dk/rafal.ca/Q",
"http://cygwin.mbwarez.dk/re.mirror.garrj",
"http://cygwin.mbwarez.dk/rg/cygwin/",
"http://cygwin.mbwarez.dk/rg/cygwin/N",
"http://cygwin.mbwarez.dk/rs/sources.red",
"http://cygwin.mbwarez.dk/t/cygwin/",
"http://cygwin.mbwarez.dk/t/cygwin//#481",
"http://cygwin.mbwarez.dk/t/cygwin/z",
"http://cygwin.mbwarez.dk/tcygwin//",
"http://cygwin.mbwarez.dk/ternode.on.net",
"http://cygwin.mbwarez.dk/tp",
"http://cygwin.mbwarez.dk/tworks.org",
"http://cygwin.mbwarez.dk/tworks.org//f",
"http://cygwin.mbwarez.dk/tworks.org/a",
"http://cygwin.mbwarez.dk/tworks.orgB",
"http://cygwin.mbwarez.dk/win",
"http://cygwin.mbwarez.dk/win.mbwarez",
"http://cygwin.mbwarez.dk/win/",
"http://cygwin.mbwarez.dk/win/;",
"http://cygwin.mbwarez.dk/win/in//",
"http://cygwin.mbwarez.dk/win/j",
"http://cygwin.mbwarez.dk/win/s.org",
"http://cygwin.mbwarez.dk/win/so.net/",
"http://cygwin.mbwarez.dk/ygwin/",
"http://cygwin.mbwarez.dk/ygwin/.net/",
"http://cygwin.mbwarez.dk/ygwin/C",
"http://cygwin.mbwarez.dk/ygwin/i",
"http://cygwin.mbwarez.dk/ygwin/in/",
"http://cygwin.mbwarez.dk/ygwin/in/O",
"http://cygwin.mbwarez.dk/ygwin/in/n",
"http://cygwin.mbwarez.dk/ygwin/j",
"http://cygwin.mbwarez.dk/ygwin/ub/c",
"http://cygwin.mbwarez.dk/ygwin/ygwin/",
"http://cygwin.mbwarez.dk/ywin/siatac",
"http://cygwin.mbwarez.dk/yz.yam",
"http://cygwin.mbwarez.dkChina",
"http://cygwin.mbwarez.dkE",
"http://cygwin.mbwarez.dkV",
"http://cygwin.mbwarez.dka.cam/",
"http://cygwin.mbwarez.dkac.jpet",
"http://cygwin.mbwarez.dkargasso.netO5",
"http://cygwin.mbwarez.dkbochum.de/-",
"http://cygwin.mbwarez.dkcn/cygw",
"http://cygwin.mbwarez.dkcomgwin/",
"http://cygwin.mbwarez.dkcygwin/",
"http://cygwin.mbwarez.dkcygwin/9",
"http://cygwin.mbwarez.dkcygwin/B",
"http://cygwin.mbwarez.dkde/cygwin/",
"http://cygwin.mbwarez.dkdeerks.org",
"http://cygwin.mbwarez.dkdein/",
"http://cygwin.mbwarez.dkdu.cnin/j",
"http://cygwin.mbwarez.dkdu.tw/pu",
"http://cygwin.mbwarez.dke/cygwin/n.de",
"http://cygwin.mbwarez.dke/pc/prog/cygwi",
"http://cygwin.mbwarez.dkerloo.cat/",
"http://cygwin.mbwarez.dket/cygwin//",
"http://cygwin.mbwarez.dket/cygwin/ay",
"http://cygwin.mbwarez.dkftp",
"http://cygwin.mbwarez.dkg",
"http://cygwin.mbwarez.dkg/cygwin/",
"http://cygwin.mbwarez.dkg/cygwin//n/$",
"http://cygwin.mbwarez.dkg/cygwin/redha",
"http://cygwin.mbwarez.dkgde/cygwin/oo",
"http://cygwin.mbwarez.dkgwin/",
"http://cygwin.mbwarez.dkin/",
"http://cygwin.mbwarez.dkirror.datacente",
"http://cygwin.mbwarez.dkirrors.filigrani",
"http://cygwin.mbwarez.dkm/cygwin/(",
"http://cygwin.mbwarez.dkn/cygwin/t",
"http://cygwin.mbwarez.dknet",
"http://cygwin.mbwarez.dknet/cygwin/;",
"http://cygwin.mbwarez.dknetworks.org/t",
"http://cygwin.mbwarez.dkngen.desoftwar",
"http://cygwin.mbwarez.dko/cygwin/",
"http://cygwin.mbwarez.dkogie.frgwin/",
"http://cygwin.mbwarez.dkorgcygwin/7",
"http://cygwin.mbwarez.dkorgn",
"http://cygwin.mbwarez.dkry.camerica",
"http://cygwin.mbwarez.dksargasso.net#",
"http://cygwin.mbwarez.dksourcewa",
"http://cygwin.mbwarez.dkt/cygwin/t//",
"http://cygwin.mbwarez.dkub/cygwin///f",
"http://cygwin.mbwarez.dkub/cygwin///m",
"http://cygwin.mbwarez.dkud.comcygwin/",
"http://cygwin.mbwarez.dkwin/",
"http://cygwin.mbwarez.dkx",
"http://cygwin.mbwarez.dkygwin/in/",
"http://cygwin.mbwarez.dkygwin/m/t",
"http://cygwin.mbwarezA",
"http://cygwin.mi",
"http://cygwin.mirror.constant.com",
"http://cygwin.mirror.constant.com%",
"http://cygwin.mirror.constant.com/",
"http://cygwin.mirror.constant.com/(",
"http://cygwin.mirror.constant.com/.byde",
"http://cygwin.mirror.constant.com/.org/U-",
"http://cygwin.mirror.constant.com//",
"http://cygwin.mirror.constant.com///a",
"http://cygwin.mirror.constant.com//C5",
"http://cygwin.mirror.constant.com//n//7;",
"http://cygwin.mirror.constant.com//net//y",
"http://cygwin.mirror.constant.com//ygwin/",
"http://cygwin.mirror.constant.com/92",
"http://cygwin.mirror.constant.com/;cygwin.mirror.constant.com;North",
"http://cygwin.mirror.constant.com/cygwin/",
"http://cygwin.mirror.constant.com/cygwin/V/",
"http://cygwin.mirror.constant.com/e:",
"http://cygwin.mirror.constant.com/et",
"http://cygwin.mirror.constant.com/et/",
"http://cygwin.mirror.constant.com/et/iO",
"http://cygwin.mirror.constant.com/gwin/cyH",
"http://cygwin.mirror.constant.com/http://m)",
"http://cygwin.mirror.constant.com/http://mz-",
"http://cygwin.mirror.constant.com/in///0",
"http://cygwin.mirror.constant.com/o.net//-",
"http://cygwin.mirror.constant.com/o.net/M",
"http://cygwin.mirror.constant.com/or.ch",
"http://cygwin.mirror.constant.com/r",
"http://cygwin.mirror.constant.com/s.org/",
"http://cygwin.mirror.constant.com/t",
"http://cygwin.mirror.constant.com/t//",
"http://cygwin.mirror.constant.com/t/p",
"http://cygwin.mirror.constant.com/tr.i",
"http://cygwin.mirror.constant.com/win/",
"http://cygwin.mirror.constant.com/win/://",
"http://cygwin.mirror.constant.com/win/K4",
"http://cygwin.mirror.constant.com/win/in/n/",
"http://cygwin.mirror.constant.com/win/n/",
"http://cygwin.mirror.constant.com/y4",
"http://cygwin.mirror.constant.com/ygwin/x",
"http://cygwin.mirror.constant.comG",
"http://cygwin.mirror.constant.comJ",
"http://cygwin.mirror.constant.comet",
"http://cygwin.mirror.constant.comn/",
"http://cygwin.mirror.constant.comn/$",
"http://cygwin.mirror.constant.comn/R4",
"http://cygwin.mirror.constant.comn32/V",
"http://cygwin.mirror.constant.comnet/",
"http://cygwin.mirror.constant.como/or."
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "238"
},
{
"description": "Uses secure TLS version for HTTPS connections",
"match_data": [
"8.43.85.97:443 -> 192.168.2.15:49714 version: TLS 1.2"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "7058"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot"
],
"id": "198",
"description": "Monitors certain registry keys / values for changes (often done to protect autostart functionality)"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"HTTP traffic on port 49704 -> 443",
"HTTP traffic on port 443 -> 49704"
],
"id": "625",
"description": "Uses HTTPS"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"refs": [
{
"ref": "#memory_dumps",
"value": "program.exe, 00000000.00000002.4544157087.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000002.4542476600.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp"
},
{
"ref": "#memory_dumps",
"value": "program.exe, 00000000.00000002.4542476600.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp"
}
],
"match_data": [
"Hyper-V RAW",
"Hyper-V RAWh"
],
"id": "263",
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"ftp://cygwin.mirror.rafal.ca/pub/cygwin/",
"ftp://ftp-stud.hs-esslingen.der",
"ftp://ftp.0",
"ftp://ftp.P",
"ftp://ftp.acc.umu.se/mirror/cygwin/http$",
"ftp://ftp.fau.de/cygwin/c",
"ftp://ftp.fsn.hu/pub/cygwin//",
"ftp://ftp.fsn.hu/pub/cygwin/rs",
"ftp://ftp.ha&",
"ftp://ftp.halifax.rwth-aachen.de/cygwin/ygwin",
"ftp://ftp.halifax.rwth-aachen.der",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://m%Ccpr;",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://G",
"ftp://ftp.iij.ad.jp/pub/cygwin/n",
"ftp://ftp.inf.tu-dresden.de",
"ftp://ftp.inf.tu-dresden.dewin/s",
"ftp://ftp.jaist.ac.jp/pub/cygwin/",
"ftp://ftp.kaist.ac.kr/cygwin/http://m",
"ftp://ftp.kaist.ac.kr/cygwin/or",
"ftp://ftp.kaist.ac.kr/cygwin/win",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://m",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://",
"ftp://ftp.kr.freebsd.orggwin/https://UA",
"ftp://ftp.lip6.fr/pub/cygwin/",
"ftp://ftp.lip6.fr/pub/cygwin//http://m%Ccpr;",
"ftp://ftp.lip6.fr/pub/cygwin//https://t",
"ftp://ftp.lip6.fr/pub/cygwin/http://m",
"ftp://ftp.lip6.fr/pub/cygwin/win/",
"ftp://ftp.lip6.frs",
"ftp://ftp.n",
"ftp://ftp.ntua.gr/pub/pc/cygwin/http://",
"ftp://ftp.rnl.tecnico.ulisboa.pt",
"ftp://ftp.snt.utwente.nlp",
"ftp://ftp.snt.utwente.nltp",
"ftp://ftp.snt.utwente.nlu.edu.cn",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/",
"ftp://ftp.yz.yamagata-u.ac.jphttp://f",
"ftp://ftp.yz.yamagata-u.ac.jpp",
"ftp://mirror.checkdomain.deftp",
"ftp://mirror.cs.vt.edu/pub/cygwin/cygwin/ors",
"ftp://mirror.datacenter.by",
"ftp://mirror.datacenter.byrrors",
"ftp://mirror.easyname.atin",
"ftp://mirror.i4",
"ftp://mirror.lagoon.nc/cygwin/https://",
"ftp://mirror.rise.ph/cygwin/cygwin/",
"ftp://mirrors.dotsrc.orgu",
"ftp://mirrors.netix.net/cygwin/https://",
"ftp://mirrors.netix.net/cygwin/https://y",
"ftp://mirrors.sonic.net/cygwin/https://",
"ftp://mirrors.sonic.net/cygwin/rs",
"ftp://mirrors.xmission.com",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/https://",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/n",
"ftp://sunsite.icm.edu.plp",
"http://ac.economia.gob.mx/cps.html0",
"http://ac.economia.gob.mx/last.crl0G",
"http://acedicom.edicomgroup.com/doc0",
"http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?",
"http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0",
"http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://ca.disig.sk/ca/crl/ca_disig.crl0",
"http://ca.mtin.es/mtin/DPCyPoliticas0",
"http://ca.mtin.es/mtin/DPCyPoliticas0g",
"http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03",
"http://ca.mtin.es/mtin/ocsp0",
"http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0",
"http://certificates.starfieldtech.com/repository/1604",
"http://certs.oati.net/repository/OATICA2.crl0",
"http://certs.oati.net/repository/OATICA2.crt0",
"http://certs.oaticerts.com/repository/OATICA2.crl",
"http://certs.oaticerts.com/repository/OATICA2.crt08",
"http://cps.chambersign.org/cps/chambersignroot.html0",
"http://cps.chambersign.org/cps/chambersroot.html0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://cps.siths.se/sithsrootcav1.html0",
"http://crl.certigna.fr/certignarootca.crl01",
"http://crl.chambersign.org/chambersignroot.crl0",
"http://crl.chambersign.org/chambersroot.crl0",
"http://crl.comodoca.com/AAACertificateServices.crl06",
"http://crl.defence.gov.au/pki0",
"http://crl.dhimyotis.com/certignarootca.crl0",
"http://crl.globalsign.net/root-r2.crl0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://crl.oces.trust2408.com/oces.crl0",
"http://crl.pki.wellsfargo.com/wsprca.crl0",
"http://crl.securetrust.com/SGCA.crl0",
"http://crl.securetrust.com/STCA.crl0",
"http://crl.ssc.lt/root-a/cacrl.crl0",
"http://crl.ssc.lt/root-b/cacrl.crl0",
"http://crl.ssc.lt/root-c/cacrl.crl0",
"http://crl.xrampsecurity.com/XGCA.crl0",
"http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
"http://ctldl.windowsupdate.com/z",
"http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635",
"http://cygwin.cathedral-",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org#",
"http://cygwin.cathedral-networks.org$",
"http://cygwin.cathedral-networks.org(",
"http://cygwin.cathedral-networks.org-hk.koddos.net/cygwin/works.org/nB",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/$",
"http://cygwin.cathedral-networks.org/%",
"http://cygwin.cathedral-networks.org/(",
"http://cygwin.cathedral-networks.org/(A",
"http://cygwin.cathedral-networks.org/.",
"http://cygwin.cathedral-networks.org/.d",
"http://cygwin.cathedral-networks.org/.l",
"http://cygwin.cathedral-networks.org/.lk",
"http://cygwin.cathedral-networks.org/.v",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org///#",
"http://cygwin.cathedral-networks.org//5",
"http://cygwin.cathedral-networks.org//c",
"http://cygwin.cathedral-networks.org//f?",
"http://cygwin.cathedral-networks.org//ftp.lip6.fro/p",
"http://cygwin.cathedral-networks.org//l",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org//mN",
"http://cygwin.cathedral-networks.org//o",
"http://cygwin.cathedral-networks.org/1",
"http://cygwin.cathedral-networks.org/5",
"http://cygwin.cathedral-networks.org/8",
"http://cygwin.cathedral-networks.org/8C",
"http://cygwin.cathedral-networks.org/:/&",
"http://cygwin.cathedral-networks.org/:EC",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/Am",
"http://cygwin.cathedral-networks.org/D",
"http://cygwin.cathedral-networks.org/E",
"http://cygwin.cathedral-networks.org/M",
"http://cygwin.cathedral-networks.org/PC",
"http://cygwin.cathedral-networks.org/R",
"http://cygwin.cathedral-networks.org/U",
"http://cygwin.cathedral-networks.org/Y",
"http://cygwin.cathedral-networks.org/a",
"http://cygwin.cathedral-networks.org/c",
"http://cygwin.cathedral-networks.org/d4",
"http://cygwin.cathedral-networks.org/e",
"http://cygwin.cathedral-networks.org/et",
"http://cygwin.cathedral-networks.org/f.",
"http://cygwin.cathedral-networks.org/ft",
"http://cygwin.cathedral-networks.org/fts",
"http://cygwin.cathedral-networks.org/g",
"http://cygwin.cathedral-networks.org/g_",
"http://cygwin.cathedral-networks.org/ia",
"http://cygwin.cathedral-networks.org/in",
"http://cygwin.cathedral-networks.org/ixG",
"http://cygwin.cathedral-networks.org/kw",
"http://cygwin.cathedral-networks.org/lA",
"http://cygwin.cathedral-networks.org/laqB4pnJ",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/mit",
"http://cygwin.cathedral-networks.org/n/",
"http://cygwin.cathedral-networks.org/ni)",
"http://cygwin.cathedral-networks.org/om",
"http://cygwin.cathedral-networks.org/ot",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/qN3p-",
"http://cygwin.cathedral-networks.org/qN6p",
"http://cygwin.cathedral-networks.org/r",
"http://cygwin.cathedral-networks.org/rX",
"http://cygwin.cathedral-networks.org/rb",
"http://cygwin.cathedral-networks.org/rr",
"http://cygwin.cathedral-networks.org/sc",
"http://cygwin.cathedral-networks.org/t",
"http://cygwin.cathedral-networks.org/th",
"http://cygwin.cathedral-networks.org/tpr",
"http://cygwin.cathedral-networks.org/ts",
"http://cygwin.cathedral-networks.org/u/",
"http://cygwin.cathedral-networks.org/um",
"http://cygwin.cathedral-networks.org/unE",
"http://cygwin.cathedral-networks.org/wi",
"http://cygwin.cathedral-networks.org/y",
"http://cygwin.cathedral-networks.org/ygxZ",
"http://cygwin.cathedral-networks.org/z",
"http://cygwin.cathedral-networks.org/~L",
"http://cygwin.cathedral-networks.org0",
"http://cygwin.cathedral-networks.org4",
"http://cygwin.cathedral-networks.org;C",
"http://cygwin.cathedral-networks.orgC",
"http://cygwin.cathedral-networks.orgTL",
"http://cygwin.cathedral-networks.orgV",
"http://cygwin.cathedral-networks.orgY",
"http://cygwin.cathedral-networks.orgZMAp1",
"http://cygwin.cathedral-networks.orga",
"http://cygwin.cathedral-networks.orgatedZ",
"http://cygwin.cathedral-networks.orgb",
"http://cygwin.cathedral-networks.orgcomR",
"http://cygwin.cathedral-networks.orgefi",
"http://cygwin.cathedral-networks.orget",
"http://cygwin.cathedral-networks.orghumG",
"http://cygwin.cathedral-networks.orgkod",
"http://cygwin.cathedral-networks.orgli",
"http://cygwin.cathedral-networks.orgmi",
"http://cygwin.cathedral-networks.orgn.me",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgr.i",
"http://cygwin.cathedral-networks.orgrs.",
"http://cygwin.cathedral-networks.orguX",
"http://cygwin.cathedral-networks.orguts",
"http://cygwin.cathedral-networks.orgx",
"http://cygwin.cathedral-networks.org~A",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk.au",
"http://cygwin.mbwarez.dk.bycygwin/",
"http://cygwin.mbwarez.dk.de$",
"http://cygwin.mbwarez.dk.de/cygwin/r",
"http://cygwin.mbwarez.dk.fau.de$",
"http://cygwin.mbwarez.dk.ntua.gr/pub/pc-",
"http://cygwin.mbwarez.dk.twaren.net/Uni4",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/.ac.nz.by/pubJ",
"http://cygwin.mbwarez.dk/.ac.nzS",
"http://cygwin.mbwarez.dk/.acc.umu.se/miw",
"http://cygwin.mbwarez.dk/.ca",
"http://cygwin.mbwarez.dk/.cn/cygwin/",
"http://cygwin.mbwarez.dk/.de/cygwin/",
"http://cygwin.mbwarez.dk/.degwin//f",
"http://cygwin.mbwarez.dk/.gr/pub/pc/cy",
"http://cygwin.mbwarez.dk/.gutscheinraus",
"http://cygwin.mbwarez.dk/.rise.ph/cy",
"http://cygwin.mbwarez.dk/.tech/pub/cyg",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk///mirror.ma",
"http://cygwin.mbwarez.dk//cy",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin//",
"http://cygwin.mbwarez.dk//cygwin/8M~po)",
"http://cygwin.mbwarez.dk//cygwin/etw",
"http://cygwin.mbwarez.dk//cygwin/goon.",
"http://cygwin.mbwarez.dk//cygwin/gw",
"http://cygwin.mbwarez.dk//cygwin/in/",
"http://cygwin.mbwarez.dk//cygwin/n/",
"http://cygwin.mbwarez.dk//cygwin/s://",
"http://cygwin.mbwarez.dk//cygwin/t.edu",
"http://cygwin.mbwarez.dk//cygwin32/",
"http://cygwin.mbwarez.dk//gwin/",
"http://cygwin.mbwarez.dk//gwin/htt",
"http://cygwin.mbwarez.dk//in/JR",
"http://cygwin.mbwarez.dk//in/win//",
"http://cygwin.mbwarez.dk//n/",
"http://cygwin.mbwarez.dk//n///",
"http://cygwin.mbwarez.dk//n/gwin/w",
"http://cygwin.mbwarez.dk//pub/cygwin/G",
"http://cygwin.mbwarez.dk/0",
"http://cygwin.mbwarez.dk/6",
"http://cygwin.mbwarez.dk/8K",
"http://cygwin.mbwarez.dk/9",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/?",
"http://cygwin.mbwarez.dk/C",
"http://cygwin.mbwarez.dk/China//",
"http://cygwin.mbwarez.dk/China0",
"http://cygwin.mbwarez.dk/Europe",
"http://cygwin.mbwarez.dk/Fpa",
"http://cygwin.mbwarez.dk/Hong",
"http://cygwin.mbwarez.dk/I",
"http://cygwin.mbwarez.dk/Moldova",
"http://cygwin.mbwarez.dk/O",
"http://cygwin.mbwarez.dk/Q",
"http://cygwin.mbwarez.dk/achen.de",
"http://cygwin.mbwarez.dk/argasso.net/9Z",
"http://cygwin.mbwarez.dk/auin/in//",
"http://cygwin.mbwarez.dk/auirror",
"http://cygwin.mbwarez.dk/bochum.de/down%",
"http://cygwin.mbwarez.dk/by",
"http://cygwin.mbwarez.dk/byfly.byen.de",
"http://cygwin.mbwarez.dk/c.jpin/or",
"http://cygwin.mbwarez.dk/c.org.ilc.jp0",
"http://cygwin.mbwarez.dk/checkdomain",
"http://cygwin.mbwarez.dk/chum.de",
"http://cygwin.mbwarez.dk/chum.de/cygwin=RAp.1",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin//",
"http://cygwin.mbwarez.dk/cygwin/://ft",
"http://cygwin.mbwarez.dk/cygwin/F",
"http://cygwin.mbwarez.dk/cygwin/in/ix",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/n//ftf",
"http://cygwin.mbwarez.dk/cygwin/n/tac",
"http://cygwin.mbwarez.dk/cygwin/p://mi",
"http://cygwin.mbwarez.dk/cygwin/win/l",
"http://cygwin.mbwarez.dk/cygwin/yname.D",
"http://cygwin.mbwarez.dk/cygwin32/c",
"http://cygwin.mbwarez.dk/d.com/cygwin/",
"http://cygwin.mbwarez.dk/e",
"http://cygwin.mbwarez.dk/e/cygwin/kod/",
"http://cygwin.mbwarez.dk/edu.cnet",
"http://cygwin.mbwarez.dk/eetin/",
"http://cygwin.mbwarez.dk/en.de",
"http://cygwin.mbwarez.dk/et.fion/",
"http://cygwin.mbwarez.dk/et/cygwin//7",
"http://cygwin.mbwarez.dk/et/cygwin/p",
"http://cygwin.mbwarez.dk/etcygwin/.ma",
"http://cygwin.mbwarez.dk/etworks.orgy",
"http://cygwin.mbwarez.dk/g/cygwin/%Kjp.",
"http://cygwin.mbwarez.dk/garr.itrror.d",
"http://cygwin.mbwarez.dk/gie.fr",
"http://cygwin.mbwarez.dk/gie.frygwin/",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin/.org//",
"http://cygwin.mbwarez.dk/gwin///k",
"http://cygwin.mbwarez.dk/gwin/cygwin/9",
"http://cygwin.mbwarez.dk/gwin/in/",
"http://cygwin.mbwarez.dk/gwin/n//",
"http://cygwin.mbwarez.dk/h.de",
"http://cygwin.mbwarez.dk/hen.de.com",
"http://cygwin.mbwarez.dk/https://mirror2Bupa5",
"http://cygwin.mbwarez.dk/ia",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in//",
"http://cygwin.mbwarez.dk/in//win/)",
"http://cygwin.mbwarez.dk/in/in//X",
"http://cygwin.mbwarez.dk/in/in/n/",
"http://cygwin.mbwarez.dk/in/in32/",
"http://cygwin.mbwarez.dk/in/n.de",
"http://cygwin.mbwarez.dk/in/n/",
"http://cygwin.mbwarez.dk/in/n/%",
"http://cygwin.mbwarez.dk/in/win/twin3",
"http://cygwin.mbwarez.dk/in/win32/",
"http://cygwin.mbwarez.dk/in/ygwin/",
"http://cygwin.mbwarez.dk/irrors/sourcew",
"http://cygwin.mbwarez.dk/jp1p",
"http://cygwin.mbwarez.dk/m",
"http://cygwin.mbwarez.dk/m/cygwin/9JpF",
"http://cygwin.mbwarez.dk/min/.",
"http://cygwin.mbwarez.dk/n/",
"http://cygwin.mbwarez.dk/n/cB",
"http://cygwin.mbwarez.dk/n/cygwin/",
"http://cygwin.mbwarez.dk/n/cygwin/(",
"http://cygwin.mbwarez.dk/n/in/in/",
"http://cygwin.mbwarez.dk/net//",
"http://cygwin.mbwarez.dk/netm",
"http://cygwin.mbwarez.dk/netn/in/",
"http://cygwin.mbwarez.dk/ng",
"http://cygwin.mbwarez.dk/om",
"http://cygwin.mbwarez.dk/om/cygwin/",
"http://cygwin.mbwarez.dk/om/cygwin/B",
"http://cygwin.mbwarez.dk/om/cygwin/c",
"http://cygwin.mbwarez.dk/om/cygwin/d.o$",
"http://cygwin.mbwarez.dk/om/cygwin/ja",
"http://cygwin.mbwarez.dk/org1",
"http://cygwin.mbwarez.dk/p",
"http://cygwin.mbwarez.dk/p.inf.tu-dresd",
"http://cygwin.mbwarez.dk/pks.orgmi",
"http://cygwin.mbwarez.dk/r/cygwin/",
"http://cygwin.mbwarez.dk/rks.org/r",
"http://cygwin.mbwarez.dk/rro",
"http://cygwin.mbwarez.dk/rror.isoc.oC",
"http://cygwin.mbwarez.dk/st",
"http://cygwin.mbwarez.dk/t/cygwin/",
"http://cygwin.mbwarez.dk/t/cygwin//",
"http://cygwin.mbwarez.dk/t/cygwin/t",
"http://cygwin.mbwarez.dk/then.de",
"http://cygwin.mbwarez.dk/ttp://ftp.f",
"http://cygwin.mbwarez.dk/ttps://",
"http://cygwin.mbwarez.dk/tworks.org/",
"http://cygwin.mbwarez.dk/u.cn",
"http://cygwin.mbwarez.dk/u.cn/cP",
"http://cygwin.mbwarez.dk/u.edu.cnC",
"http://cygwin.mbwarez.dk/ub/cygwin/cBVp",
"http://cygwin.mbwarez.dk/ucomP",
"http://cygwin.mbwarez.dk/wente.nlno/tG",
"http://cygwin.mbwarez.dk/win/",
"http://cygwin.mbwarez.dk/win/3",
"http://cygwin.mbwarez.dk/win/acente",
"http://cygwin.mbwarez.dk/win/gwin/O",
"http://cygwin.mbwarez.dk/win/in/:",
"http://cygwin.mbwarez.dk/win/it",
"http://cygwin.mbwarez.dk/win/n/(",
"http://cygwin.mbwarez.dk/win/win/",
"http://cygwin.mbwarez.dk/win/win/p://Z",
"http://cygwin.mbwarez.dk/ygwin/",
"http://cygwin.mbwarez.dk/ygwin/.ncH",
"http://cygwin.mbwarez.dk/ygwin//",
"http://cygwin.mbwarez.dk/ygwin/E",
"http://cygwin.mbwarez.dk/ygwin/I",
"http://cygwin.mbwarez.dk/ygwin/cyg",
"http://cygwin.mbwarez.dk/ygwin/cygwin/",
"http://cygwin.mbwarez.dk/ygwin/n/",
"http://cygwin.mbwarez.dk0",
"http://cygwin.mbwarez.dkI",
"http://cygwin.mbwarez.dkaachen.de;",
"http://cygwin.mbwarez.dkaachen.dewin/",
"http://cygwin.mbwarez.dkachen",
"http://cygwin.mbwarez.dkare.mirror.garr",
"http://cygwin.mbwarez.dkarez.d",
"http://cygwin.mbwarez.dkargasso.netkod/",
"http://cygwin.mbwarez.dkauc.nzin/",
"http://cygwin.mbwarez.dkauwin/p://ftp"
],
"id": "238",
"description": "URLs found in memory or binary data"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\ETCJ2WHM"
],
"id": "90",
"description": "Creates files inside the user directory"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"8.43.85.97:443 -> 192.168.2.9:49704 version: TLS 1.2"
],
"id": "7058",
"description": "Uses secure TLS version for HTTPS connections"
},
{
"id": "625",
"match_data": [
"HTTP traffic on port 443 -> 49720",
"HTTP traffic on port 49720 -> 443"
],
"description": "Uses HTTPS",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "263",
"refs": [
{
"ref": "#memory_dumps",
"value": "file.exe, 00000001.00000002.4863440201.000000000013E000.00000004.00000020.00020000.00000000.sdmp"
},
{
"ref": "#memory_dumps",
"value": "file.exe, 00000001.00000002.4863975444.0000000000185000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.4862480485.00000000000B8000.00000004.00000020.00020000.00000000.sdmp"
}
],
"match_data": [
"Hyper-V RAW ^",
"Hyper-V RAW"
],
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "238",
"match_data": [
"ftp://cygwin.mirror.rafal.cap",
"ftp://ftp.acc.umu.se/mirror/cygwin/http",
"ftp://ftp.byfly.by/pub/cygwin/in",
"ftp://ftp.byfly.by/pub/cygwin/win/",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/https://",
"ftp://ftp.fau.de/cygwin/.can",
"ftp://ftp.fau.de/cygwin/c",
"ftp://ftp.fs",
"ftp://ftp.fsn.hu/pub/cygwin/irror",
"ftp://ftp.fsn.hu/pub/cygwin/r",
"ftp://ftp.fsn.hu/pub/cygwin/s",
"ftp://ftp.fsn.hu/pub/cygwin/ygwin",
"ftp://ftp.fsn.huhttps:/",
"ftp://ftp.funet.fi",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/gwin/https://",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/org",
"ftp://ftp.halifax.rwth-aachen.de/cygwin/http://m",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://m~",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://S",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://V",
"ftp://ftp.inf.tu-dresden.de/software/windows/cygwin32/kdomain",
"ftp://ftp.kaist.ac.kr/cygwin/in/arr.itgen.denet",
"ftp://ftp.kr.freebsd.org",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://cr",
"ftp://ftp.kr.freebsd.orghttps://",
"ftp://ftp.kr.freebsd.orgygwin/https://",
"ftp://ftp.lip6.fr/pub/cygwin/",
"ftp://ftp.lip6.fr/pub/cygwin/in/https://U",
"ftp://ftp.lip6.fr/pub/cygwin/p",
"ftp://ftp.mirrorservice.org/sites/sourceware.org/pub/cygwin/",
"ftp://ftp.mirrorservice.org/sites/sourceware.org/pub/cygwin/gwin",
"ftp://ftp.n",
"ftp://ftp.nP",
"ftp://ftp.ntua.gr/pub/pc/cygwin/",
"ftp://ftp.ntua.gr/pub/pc/cygwin/https://U",
"ftp://ftp.ntua.grhttps:",
"ftp://ftp.rn",
"ftp://ftp.rnl.tecnico.ulisboa.pt/pub/cygwin/http://m",
"ftp://ftp.snt.utwente.nl",
"ftp://ftp.snt.utwente.nlt",
"ftp://ftp.x",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/c",
"ftp://linux.rz.ruhr-uni-bochum.de/cygwin/https://",
"ftp://mirror.checkdomain.de/cygwin/https://ftp.i",
"ftp://mirror.easyname.athttp://c",
"ftp://mirror.internode.on.net/pub/cygwin/",
"ftp://mirror.internode.on.netrs",
"ftp://mirror.lagoon.nc/cygwin/http://fV",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/in/",
"ftp://mirrors.dotsrc.orggn.dehttp://f=",
"ftp://mirrors.dotsrc.orgn.deom",
"ftp://mirrors.xmission.com/cygwin/com/http://fL",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin///http://m",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://m",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/https://",
"http://ac.economia.gob.mx/cps.html0",
"http://ac.economia.gob.mx/last.crl0G",
"http://acedicom.edicomgroup.com/doc0",
"http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?",
"http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0",
"http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://ca.disig.sk/ca/crl/ca_disig.crl0",
"http://ca.mtin.es/mtin/DPCyPoliticas0",
"http://ca.mtin.es/mtin/DPCyPoliticas0g",
"http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03",
"http://ca.mtin.es/mtin/ocsp0",
"http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0",
"http://certificates.starfieldtech.com/repository/1604",
"http://certs.oati.net/repository/OATICA2.crl0",
"http://certs.oati.net/repository/OATICA2.crt0",
"http://certs.oaticerts.com/repository/OATICA2.crl",
"http://certs.oaticerts.com/repository/OATICA2.crt08",
"http://cps.chambersign.org/cps/chambersignroot.html0",
"http://cps.chambersign.org/cps/chambersroot.html0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://cps.siths.se/sithsrootcav1.html0",
"http://crl.certigna.fr/certignarootca.crl01",
"http://crl.chambersign.org/chambersignroot.crl0",
"http://crl.chambersign.org/chambersroot.crl0",
"http://crl.comodoca.com/AAACertificateServices.crl06",
"http://crl.defence.gov.au/pki0",
"http://crl.dhimyotis.com/certignarootca.crl0",
"http://crl.globalsign.net/root-r2.crl0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://crl.oces.trust2408.com/oces.crl0",
"http://crl.pki.wellsfargo.com/wsprca.crl0",
"http://crl.securetrust.com/SGCA.crl0",
"http://crl.securetrust.com/STCA.crl0",
"http://crl.ssc.lt/root-a/cacrl.crl0",
"http://crl.ssc.lt/root-b/cacrl.crl0",
"http://crl.ssc.lt/root-c/cacrl.crl0",
"http://crl.xrampsecurity.com/XGCA.crl0",
"http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0",
"http://ctldl.windowsupdate.com/R",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en031b9",
"http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635",
"http://cygwin.cathedral-",
"http://cygwin.cathedral-.",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org%",
"http://cygwin.cathedral-networks.org-itU",
"http://cygwin.cathedral-networks.org.",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/#",
"http://cygwin.cathedral-networks.org/%",
"http://cygwin.cathedral-networks.org/(",
"http://cygwin.cathedral-networks.org/)",
"http://cygwin.cathedral-networks.org/-m",
"http://cygwin.cathedral-networks.org/.eS",
"http://cygwin.cathedral-networks.org/.o",
"http://cygwin.cathedral-networks.org/.s",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org//&",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org///E",
"http://cygwin.cathedral-networks.org///g",
"http://cygwin.cathedral-networks.org//U",
"http://cygwin.cathedral-networks.org//f",
"http://cygwin.cathedral-networks.org//l",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org//mX",
"http://cygwin.cathedral-networks.org//o",
"http://cygwin.cathedral-networks.org/5",
"http://cygwin.cathedral-networks.org/:",
"http://cygwin.cathedral-networks.org/:/-",
"http://cygwin.cathedral-networks.org/;",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/B",
"http://cygwin.cathedral-networks.org/D",
"http://cygwin.cathedral-networks.org/E",
"http://cygwin.cathedral-networks.org/Europe",
"http://cygwin.cathedral-networks.org/K",
"http://cygwin.cathedral-networks.org/L",
"http://cygwin.cathedral-networks.org/M",
"http://cygwin.cathedral-networks.org/R",
"http://cygwin.cathedral-networks.org/a",
"http://cygwin.cathedral-networks.org/a=",
"http://cygwin.cathedral-networks.org/c",
"http://cygwin.cathedral-networks.org/cy",
"http://cygwin.cathedral-networks.org/du",
"http://cygwin.cathedral-networks.org/e/",
"http://cygwin.cathedral-networks.org/ed",
"http://cygwin.cathedral-networks.org/f",
"http://cygwin.cathedral-networks.org/ftg",
"http://cygwin.cathedral-networks.org/gwN",
"http://cygwin.cathedral-networks.org/h",
"http://cygwin.cathedral-networks.org/in",
"http://cygwin.cathedral-networks.org/irD",
"http://cygwin.cathedral-networks.org/k",
"http://cygwin.cathedral-networks.org/l(",
"http://cygwin.cathedral-networks.org/la",
"http://cygwin.cathedral-networks.org/li",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/mT",
"http://cygwin.cathedral-networks.org/mi",
"http://cygwin.cathedral-networks.org/n/",
"http://cygwin.cathedral-networks.org/nl",
"http://cygwin.cathedral-networks.org/o.",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/p:",
"http://cygwin.cathedral-networks.org/pl",
"http://cygwin.cathedral-networks.org/pu_",
"http://cygwin.cathedral-networks.org/r",
"http://cygwin.cathedral-networks.org/rs",
"http://cygwin.cathedral-networks.org/s.",
"http://cygwin.cathedral-networks.org/t",
"http://cygwin.cathedral-networks.org/t.",
"http://cygwin.cathedral-networks.org/t.z",
"http://cygwin.cathedral-networks.org/te",
"http://cygwin.cathedral-networks.org/tp",
"http://cygwin.cathedral-networks.org/tv",
"http://cygwin.cathedral-networks.org/uw",
"http://cygwin.cathedral-networks.org/w",
"http://cygwin.cathedral-networks.org/x",
"http://cygwin.cathedral-networks.org0",
"http://cygwin.cathedral-networks.org1",
"http://cygwin.cathedral-networks.org2",
"http://cygwin.cathedral-networks.orgG",
"http://cygwin.cathedral-networks.orgM",
"http://cygwin.cathedral-networks.orga",
"http://cygwin.cathedral-networks.orge",
"http://cygwin.cathedral-networks.orget",
"http://cygwin.cathedral-networks.orgf",
"http://cygwin.cathedral-networks.orgftp",
"http://cygwin.cathedral-networks.orggwi",
"http://cygwin.cathedral-networks.orgk",
"http://cygwin.cathedral-networks.orgl",
"http://cygwin.cathedral-networks.orgn",
"http://cygwin.cathedral-networks.orgn.ct",
"http://cygwin.cathedral-networks.orgn.v",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgnf.",
"http://cygwin.cathedral-networks.orgny",
"http://cygwin.cathedral-networks.orgr",
"http://cygwin.cathedral-networks.orgs:/",
"http://cygwin.cathedral-networks.orgtp",
"http://cygwin.cathedral-networks.orgtp:",
"http://cygwin.cathedral-networks.orgttp",
"http://cygwin.cathedral-networks.orgwaren.net",
"http://cygwin.cathedral-networks.orgygw",
"http://cygwin.mbwarez",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk%",
"http://cygwin.mbwarez.dk)",
"http://cygwin.mbwarez.dk-bochum.detwar",
"http://cygwin.mbwarez.dk.ac.jp",
"http://cygwin.mbwarez.dk.com/cygwin/",
"http://cygwin.mbwarez.dk.com/cygwin/K",
"http://cygwin.mbwarez.dk.de",
"http://cygwin.mbwarez.dk.de/cygwin/",
"http://cygwin.mbwarez.dk.deom/cygwin/",
"http://cygwin.mbwarez.dk.fau.de/cygwin/",
"http://cygwin.mbwarez.dk.garr.it/n/t",
"http://cygwin.mbwarez.dk.garr.itet/",
"http://cygwin.mbwarez.dk.neto.",
"http://cygwin.mbwarez.dk.org/mirror-hk",
"http://cygwin.mbwarez.dk.orge-",
"http://cygwin.mbwarez.dk.twaren.netome",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/#",
"http://cygwin.mbwarez.dk/$",
"http://cygwin.mbwarez.dk/%8",
"http://cygwin.mbwarez.dk/-",
"http://cygwin.mbwarez.dk/.ac.nz/",
"http://cygwin.mbwarez.dk/.com/win/:",
"http://cygwin.mbwarez.dk/.de.netynZ",
"http://cygwin.mbwarez.dk/.de/",
"http://cygwin.mbwarez.dk/.de/cygwin/t",
"http://cygwin.mbwarez.dk/.fsn.hue",
"http://cygwin.mbwarez.dk/.jpygwin/1",
"http://cygwin.mbwarez.dk/.lip6.fr",
"http://cygwin.mbwarez.dk/.n",
"http://cygwin.mbwarez.dk/.net",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk///",
"http://cygwin.mbwarez.dk///cygwin/",
"http://cygwin.mbwarez.dk///ygwin/K",
"http://cygwin.mbwarez.dk///ygwin32/1",
"http://cygwin.mbwarez.dk//1",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin//",
"http://cygwin.mbwarez.dk//cygwin/in/",
"http://cygwin.mbwarez.dk//cygwin/n$",
"http://cygwin.mbwarez.dk//cygwin/n/o",
"http://cygwin.mbwarez.dk//cygwin/ps://",
"http://cygwin.mbwarez.dk//cygwin/win/",
"http://cygwin.mbwarez.dk//gwin/",
"http://cygwin.mbwarez.dk//gwin/Z",
"http://cygwin.mbwarez.dk//in/",
"http://cygwin.mbwarez.dk//mirror.easyna",
"http://cygwin.mbwarez.dk//pub/cygwin/Z",
"http://cygwin.mbwarez.dk//win//A",
"http://cygwin.mbwarez.dk/0",
"http://cygwin.mbwarez.dk/1",
"http://cygwin.mbwarez.dk/3",
"http://cygwin.mbwarez.dk/5",
"http://cygwin.mbwarez.dk/:",
"http://cygwin.mbwarez.dk/;",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/AM",
"http://cygwin.mbwarez.dk/C",
"http://cygwin.mbwarez.dk/Japan",
"http://cygwin.mbwarez.dk/K",
"http://cygwin.mbwarez.dk/O",
"http://cygwin.mbwarez.dk/U",
"http://cygwin.mbwarez.dk/V",
"http://cygwin.mbwarez.dk/a8",
"http://cygwin.mbwarez.dk/ac.jpneusoft.",
"http://cygwin.mbwarez.dk/ad.jp",
"http://cygwin.mbwarez.dk/bochum.de://m",
"http://cygwin.mbwarez.dk/c.jp",
"http://cygwin.mbwarez.dk/c.jpygwin/.c",
"http://cygwin.mbwarez.dk/cnico.ulisb",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin//",
"http://cygwin.mbwarez.dk/cygwin//t",
"http://cygwin.mbwarez.dk/cygwin/K",
"http://cygwin.mbwarez.dk/cygwin/e",
"http://cygwin.mbwarez.dk/cygwin/l",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/ree",
"http://cygwin.mbwarez.dk/cygwin32/",
"http://cygwin.mbwarez.dk/d.comwin/",
"http://cygwin.mbwarez.dk/de/cygwin/n/D",
"http://cygwin.mbwarez.dk/derks.org/j",
"http://cygwin.mbwarez.dk/e",
"http://cygwin.mbwarez.dk/e/cygwin/s://",
"http://cygwin.mbwarez.dk/edu.cnwin/",
"http://cygwin.mbwarez.dk/en.dein/l",
"http://cygwin.mbwarez.dk/er.it",
"http://cygwin.mbwarez.dk/et",
"http://cygwin.mbwarez.dk/et/cygwin/e",
"http://cygwin.mbwarez.dk/etm.deZ",
"http://cygwin.mbwarez.dk/etum.de",
"http://cygwin.mbwarez.dk/gie.frygwin/",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin/-",
"http://cygwin.mbwarez.dk/gwin//",
"http://cygwin.mbwarez.dk/gwin/2",
"http://cygwin.mbwarez.dk/gwin/4",
"http://cygwin.mbwarez.dk/gwin/aet/",
"http://cygwin.mbwarez.dk/gwin/in/",
"http://cygwin.mbwarez.dk/gwin/p",
"http://cygwin.mbwarez.dk/gwin/s",
"http://cygwin.mbwarez.dk/gwin/u",
"http://cygwin.mbwarez.dk/gwin/win/",
"http://cygwin.mbwarez.dk/h",
"http://cygwin.mbwarez.dk/h.de",
"http://cygwin.mbwarez.dk/hen.de",
"http://cygwin.mbwarez.dk/hen.dein/w",
"http://cygwin.mbwarez.dk/hen.den/",
"http://cygwin.mbwarez.dk/https://",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in/&",
"http://cygwin.mbwarez.dk/in//",
"http://cygwin.mbwarez.dk/in/9G",
"http://cygwin.mbwarez.dk/in/:",
"http://cygwin.mbwarez.dk/in/ch",
"http://cygwin.mbwarez.dk/in/chhinas",
"http://cygwin.mbwarez.dk/in/cygwin/D",
"http://cygwin.mbwarez.dk/in/gwin/",
"http://cygwin.mbwarez.dk/in/gwin/e",
"http://cygwin.mbwarez.dk/in/ttp://mQ",
"http://cygwin.mbwarez.dk/in/usoft.e",
"http://cygwin.mbwarez.dk/in/ygwin/.",
"http://cygwin.mbwarez.dk/irrors.ustc",
"http://cygwin.mbwarez.dk/ites/sourceware.org/pub/cygwin/ygwin/yz.yamagata-u.ac.jp3",
"http://cygwin.mbwarez.dk/loo.cagwin/",
"http://cygwin.mbwarez.dk/m",
"http://cygwin.mbwarez.dk/m8",
"http://cygwin.mbwarez.dk/n/",
"http://cygwin.mbwarez.dk/n/cygwin/",
"http://cygwin.mbwarez.dk/n/cygwin/edu.",
"http://cygwin.mbwarez.dk/n/gwin32/4",
"http://cygwin.mbwarez.dk/n/in/",
"http://cygwin.mbwarez.dk/n/n/Y",
"http://cygwin.mbwarez.dk/n/win/p",
"http://cygwin.mbwarez.dk/net",
"http://cygwin.mbwarez.dk/netso.net/",
"http://cygwin.mbwarez.dk/no/cygwin/",
"http://cygwin.mbwarez.dk/o/cygwin/ats",
"http://cygwin.mbwarez.dk/om/cygwin/",
"http://cygwin.mbwarez.dk/om/cygwin/lftp.twaren.net",
"http://cygwin.mbwarez.dk/or.internode.o",
"http://cygwin.mbwarez.dk/p6.frV",
"http://cygwin.mbwarez.dk/p://ftp.1",
"http://cygwin.mbwarez.dk/pub/cygwin/",
"http://cygwin.mbwarez.dk/pub/cygwin/c",
"http://cygwin.mbwarez.dk/rg",
"http://cygwin.mbwarez.dk/rg/cygwin/",
"http://cygwin.mbwarez.dk/rg/cygwin/y",
"http://cygwin.mbwarez.dk/riapub/cygq",
"http://cygwin.mbwarez.dk/rs.163.com",
"http://cygwin.mbwarez.dk/rth",
"http://cygwin.mbwarez.dk/st",
"http://cygwin.mbwarez.dk/st.comn/",
"http://cygwin.mbwarez.dk/t/cygwin/;",
"http://cygwin.mbwarez.dk/thttps://",
"http://cygwin.mbwarez.dk/twin/stc.edu",
"http://cygwin.mbwarez.dk/u.cawin/",
"http://cygwin.mbwarez.dk/u.cnitr/cygw",
"http://cygwin.mbwarez.dk/win//in/",
"http://cygwin.mbwarez.dk/win/c",
"http://cygwin.mbwarez.dk/win/gwin/",
"http://cygwin.mbwarez.dk/win/in/k",
"http://cygwin.mbwarez.dk/win/kdomai",
"http://cygwin.mbwarez.dk/win/n/",
"http://cygwin.mbwarez.dk/win/n/win",
"http://cygwin.mbwarez.dk/win/rope",
"http://cygwin.mbwarez.dk/win/ygwin/m",
"http://cygwin.mbwarez.dk/x/sourceware.o",
"http://cygwin.mbwarez.dk/y/pub/mirrors/",
"http://cygwin.mbwarez.dk/y2",
"http://cygwin.mbwarez.dk/ygwin/",
"http://cygwin.mbwarez.dk/ygwin///",
"http://cygwin.mbwarez.dk/ygwin/2/",
"http://cygwin.mbwarez.dk/ygwin/6",
"http://cygwin.mbwarez.dk/ygwin/H",
"http://cygwin.mbwarez.dk/ygwin/N",
"http://cygwin.mbwarez.dk/ygwin/g.ca",
"http://cygwin.mbwarez.dk/ygwin/in/-",
"http://cygwin.mbwarez.dk/ygwin/n/",
"http://cygwin.mbwarez.dk/ygwin/r",
"http://cygwin.mbwarez.dk/ygwin/rors",
"http://cygwin.mbwarez.dk/ygwin/t",
"http://cygwin.mbwarez.dk/ygwin/tn/",
"http://cygwin.mbwarez.dk/ygwin/ygwin/",
"http://cygwin.mbwarez.dkD",
"http://cygwin.mbwarez.dkG",
"http://cygwin.mbwarez.dkK",
"http://cygwin.mbwarez.dkMoldova3",
"http://cygwin.mbwarez.dkP",
"http://cygwin.mbwarez.dkQ8"
],
"description": "URLs found in memory or binary data",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "7058",
"match_data": [
"8.43.85.97:443 -> 192.168.2.14:49720 version: TLS 1.2"
],
"description": "Uses secure TLS version for HTTPS connections",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"description": "Monitors certain registry keys / values for changes (often done to protect autostart functionality)",
"match_data": [
"HKEY_CURRENT_USER_Classes"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "198"
},
{
"description": "Uses HTTPS",
"match_data": [
"HTTP traffic on port 443 -> 49738",
"HTTP traffic on port 49738 -> 443"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "625"
},
{
"refs": [
{
"ref": "#memory_dumps",
"value": "software.exe, 00000000.00000002.4632916603.0000000000181000.00000004.00000020.00020000.00000000.sdmp"
},
{
"ref": "#memory_dumps",
"value": "software.exe, 00000000.00000002.4632393130.0000000000128000.00000004.00000020.00020000.00000000.sdmp"
}
],
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)",
"match_data": [
"Hyper-V RAW",
"Hyper-V RAWl"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "263"
},
{
"description": "URLs found in memory or binary data",
"match_data": [
"ftp://ftp-stud.hs-esslingen.dein",
"ftp://ftp.byfly.by/pub/cygwin/ror",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin//or",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://c",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/https://",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/n",
"ftp://ftp.fs%CJ",
"ftp://ftp.fsn.hu/pub/cygwin/tp",
"ftp://ftp.fsn.huy",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/s",
"ftp://ftp.halifax.rwth-aachen.de",
"ftp://ftp.iij.ad.jp/pub/cygwin/",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://m",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.iij.ad.jp/pub/cygwin/n",
"ftp://ftp.inf.tu-dresden.de",
"ftp://ftp.inf.tu-dresden.dejphttp://maq#",
"ftp://ftp.inf.tu-dresden.demirror",
"ftp://ftp.jaist.ac.jp/pub/cygwin/",
"ftp://ftp.kaist.ac.kr/cygwin/ftp",
"ftp://ftp.kaist.ac.kr/cygwin/https://",
"ftp://ftp.kaist.ac.kr/cygwin/or",
"ftp://ftp.kaist.ac.kr/cygwin/ror",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/or",
"ftp://ftp.kr.freebsd.orgchen.dep",
"ftp://ftp.kr.freebsd.orgetg",
"ftp://ftp.kr.freebsd.orggwin/",
"ftp://ftp.l",
"ftp://ftp.lip6.fr/pub/cygwin/",
"ftp://ftp.muug.ca",
"ftp://ftp.n",
"ftp://ftp.ntua.gr/pub/pc/cygwin/",
"ftp://ftp.nu",
"ftp://ftp.rnl.tecnico.ulisboa.pt",
"ftp://ftp.rnl.tecnico.ulisboa.ptn",
"ftp://ftp.snt.utwente.nlst",
"ftp://ftp.snt.utwente.nlygwin/http://f",
"ftp://ftp.snt.utwente.nlz",
"ftp://ftp.twaren.net/Unix/sourceware.org/cygwin/https:",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/https://",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/n",
"ftp://ftp.yz.yamagata-u.ac.jphttps://",
"ftp://ftp.yz.yamagata-u.ac.jpin/",
"ftp://linux.rz.ruhr-uni-bochum.de",
"ftp://linux.rz.ruhr-uni-bochum.de/cygwin/n/",
"ftp://mirror.checkdomain.demirror",
"ftp://mirror.checkdomain.deygwin/",
"ftp://mirror.cs.vt.edu/pub/cygwin/cygwin/ygwin/",
"ftp://mirror.csclub.uwaterloo.ca/cygwin/",
"ftp://mirror.csclub.uwaterloo.ca/cygwin/.dk//https://",
"ftp://mirror.csclub.uwaterloo.ca/cygwin/http://",
"ftp://mirror.easyname.at/cygwin//",
"ftp://mirror.easyname.athttp://mirror.)",
"ftp://mirror.internode.on.net/pub/cygwin/http",
"ftp://mirror.internode.on.net/pub/cygwin/n/",
"ftp://mirror.internode.on.net/pub/cygwin/win/https://",
"ftp://mirror.internode.on.netin/",
"ftp://mirror.lagoon.nc/cygwin/",
"ftp://mirror.lagoon.nc/cygwin/r",
"ftp://mirror.rise.ph/cygwin/cygwin/http",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/.net/",
"ftp://mirrors.sonic.net/cygwin/",
"ftp://mirrors.syringanetworks.net",
"ftp://mirrors.syringanetworks.net/cygwin/",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://mmVT",
"http://ac.economia.gob.mx/cps.html0",
"http://ac.economia.gob.mx/last.crl0G",
"http://acedicom.edicomgroup.com/doc0",
"http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?",
"http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0",
"http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0",
"http://apps.identrust.com/roots/dstrootcax3",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://ca.disig.sk/ca/crl/ca_disig.crl0",
"http://ca.mtin.es/mtin/DPCyPoliticas0",
"http://ca.mtin.es/mtin/DPCyPoliticas0g",
"http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03",
"http://ca.mtin.es/mtin/ocsp0",
"http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0",
"http://certificates.starfieldtech.com/repository/1604",
"http://certs.oati.net/repository/OATICA2.crl0",
"http://certs.oati.net/repository/OATICA2.crt0",
"http://certs.oaticerts.com/repository/OATICA2.crl",
"http://certs.oaticerts.com/repository/OATICA2.crt08",
"http://cps.chambersign.org/cps/chambersignroot.html0",
"http://cps.chambersign.org/cps/chambersroot.html0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://cps.siths.se/sithsrootcav1.html0",
"http://crl.certigna.fr/certignarootca.crl01",
"http://crl.chambersign.org/chambersignroot.crl0",
"http://crl.chambersign.org/chambersroot.crl0",
"http://crl.comodoca.com/AAACertificateServices.crl06",
"http://crl.defence.gov.au/pki0",
"http://crl.dhimyotis.com/certignarootca.crl0",
"http://crl.globalsign.net/root-r2.crl0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://crl.oces.trust2408.com/oces.crl0",
"http://crl.pki.wellsfargo.com/wsprca.crl0",
"http://crl.securetrust.com/SGCA.crl0",
"http://crl.securetrust.com/STCA.crl0",
"http://crl.ssc.lt/root-a/cacrl.crl0",
"http://crl.ssc.lt/root-b/cacrl.crl0",
"http://crl.ssc.lt/root-c/cacrl.crl0",
"http://crl.xrampsecurity.com/XGCA.crl0",
"http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0",
"http://ctldl.windowsupdate.com/Jg-AJ",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enEM32",
"http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635",
"http://cygwin.cathedral-",
"http://cygwin.cathedral-7T",
"http://cygwin.cathedral-networks",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org$h",
"http://cygwin.cathedral-networks.org-f",
"http://cygwin.cathedral-networks.org.ed-",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/&G",
"http://cygwin.cathedral-networks.org/(v",
"http://cygwin.cathedral-networks.org/.",
"http://cygwin.cathedral-networks.org/.i",
"http://cygwin.cathedral-networks.org/.j",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org//-v",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org///.X",
"http://cygwin.cathedral-networks.org//=j",
"http://cygwin.cathedral-networks.org//NU6",
"http://cygwin.cathedral-networks.org//Pj&",
"http://cygwin.cathedral-networks.org//SP$",
"http://cygwin.cathedral-networks.org//fPV",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org/0M",
"http://cygwin.cathedral-networks.org/://",
"http://cygwin.cathedral-networks.org/;D",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/C",
"http://cygwin.cathedral-networks.org/Ev5",
"http://cygwin.cathedral-networks.org/FX",
"http://cygwin.cathedral-networks.org/Hk/",
"http://cygwin.cathedral-networks.org/Ih/",
"http://cygwin.cathedral-networks.org/Ji/",
"http://cygwin.cathedral-networks.org/Jj",
"http://cygwin.cathedral-networks.org/Ld",
"http://cygwin.cathedral-networks.org/Ti%",
"http://cygwin.cathedral-networks.org/Uf%",
"http://cygwin.cathedral-networks.org/Uk",
"http://cygwin.cathedral-networks.org/W",
"http://cygwin.cathedral-networks.org/_",
"http://cygwin.cathedral-networks.org/_C",
"http://cygwin.cathedral-networks.org/_f#",
"http://cygwin.cathedral-networks.org/ad/l",
"http://cygwin.cathedral-networks.org/al",
"http://cygwin.cathedral-networks.org/an",
"http://cygwin.cathedral-networks.org/c",
"http://cygwin.cathedral-networks.org/cy",
"http://cygwin.cathedral-networks.org/d",
"http://cygwin.cathedral-networks.org/eD",
"http://cygwin.cathedral-networks.org/f",
"http://cygwin.cathedral-networks.org/fr",
"http://cygwin.cathedral-networks.org/ftXS",
"http://cygwin.cathedral-networks.org/ftnWT",
"http://cygwin.cathedral-networks.org/hp",
"http://cygwin.cathedral-networks.org/ia",
"http://cygwin.cathedral-networks.org/ih",
"http://cygwin.cathedral-networks.org/in",
"http://cygwin.cathedral-networks.org/j/",
"http://cygwin.cathedral-networks.org/jU",
"http://cygwin.cathedral-networks.org/jX",
"http://cygwin.cathedral-networks.org/kf",
"http://cygwin.cathedral-networks.org/lisboa.pth.de/mirror/cygwin/",
"http://cygwin.cathedral-networks.org/mRX",
"http://cygwin.cathedral-networks.org/ma",
"http://cygwin.cathedral-networks.org/mi",
"http://cygwin.cathedral-networks.org/nCh",
"http://cygwin.cathedral-networks.org/o",
"http://cygwin.cathedral-networks.org/oniC",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/p.%j",
"http://cygwin.cathedral-networks.org/reLg/",
"http://cygwin.cathedral-networks.org/s:",
"http://cygwin.cathedral-networks.org/ss",
"http://cygwin.cathedral-networks.org/st",
"http://cygwin.cathedral-networks.org/t",
"http://cygwin.cathedral-networks.org/t-",
"http://cygwin.cathedral-networks.org/ti",
"http://cygwin.cathedral-networks.org/tp",
"http://cygwin.cathedral-networks.org/tpdXb",
"http://cygwin.cathedral-networks.org/tt",
"http://cygwin.cathedral-networks.org/ur",
"http://cygwin.cathedral-networks.org/uy",
"http://cygwin.cathedral-networks.org/xk8AU",
"http://cygwin.cathedral-networks.org/y",
"http://cygwin.cathedral-networks.org/yaT",
"http://cygwin.cathedral-networks.org/ygj",
"http://cygwin.cathedral-networks.org6j",
"http://cygwin.cathedral-networks.org://",
"http://cygwin.cathedral-networks.org://2g",
"http://cygwin.cathedral-networks.orgAU;",
"http://cygwin.cathedral-networks.orgPR%",
"http://cygwin.cathedral-networks.orgTl(",
"http://cygwin.cathedral-networks.org_f#",
"http://cygwin.cathedral-networks.orgag",
"http://cygwin.cathedral-networks.orgal-",
"http://cygwin.cathedral-networks.orgboc",
"http://cygwin.cathedral-networks.orgd.o6",
"http://cygwin.cathedral-networks.orgdos",
"http://cygwin.cathedral-networks.orgdxQ",
"http://cygwin.cathedral-networks.orgd~",
"http://cygwin.cathedral-networks.orge",
"http://cygwin.cathedral-networks.orge1U",
"http://cygwin.cathedral-networks.orgebs",
"http://cygwin.cathedral-networks.orgeti",
"http://cygwin.cathedral-networks.orgft",
"http://cygwin.cathedral-networks.orggwi;f",
"http://cygwin.cathedral-networks.orgl-",
"http://cygwin.cathedral-networks.orgmT",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgn/Oj7",
"http://cygwin.cathedral-networks.orgomLh",
"http://cygwin.cathedral-networks.orgps",
"http://cygwin.cathedral-networks.orgr-h",
"http://cygwin.cathedral-networks.orgr.c",
"http://cygwin.cathedral-networks.orgror",
"http://cygwin.cathedral-networks.orgt",
"http://cygwin.cathedral-networks.orgtp",
"http://cygwin.cathedral-networks.orgtp.",
"http://cygwin.cathedral-networks.orgw",
"http://cygwin.cathedral-networks.orgwin",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk.ac.jpin/~d",
"http://cygwin.mbwarez.dk.aun/om/",
"http://cygwin.mbwarez.dk.de",
"http://cygwin.mbwarez.dk.de/cygwin/",
"http://cygwin.mbwarez.dk.de/cygwin/n/",
"http://cygwin.mbwarez.dk.de/cygwin/nq",
"http://cygwin.mbwarez.dk.dk/ygwin/omtZ",
"http://cygwin.mbwarez.dk.fau.den.dem$W",
"http://cygwin.mbwarez.dk.net",
"http://cygwin.mbwarez.dk.net.de/cygw",
"http://cygwin.mbwarez.dk.orgmin/n/",
"http://cygwin.mbwarez.dk.orgygwin/8k",
"http://cygwin.mbwarez.dk.tech//in/",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/$",
"http://cygwin.mbwarez.dk/(u$",
"http://cygwin.mbwarez.dk/.",
"http://cygwin.mbwarez.dk/.cawin/in/gk",
"http://cygwin.mbwarez.dk/.cn//win/",
"http://cygwin.mbwarez.dk/.cn/cygwin/2QQ",
"http://cygwin.mbwarez.dk/.com",
"http://cygwin.mbwarez.dk/.de/pub/cygwi",
"http://cygwin.mbwarez.dk/.edu.cn",
"http://cygwin.mbwarez.dk/.edu.cnr",
"http://cygwin.mbwarez.dk/.edu.cntp://l",
"http://cygwin.mbwarez.dk/.lagoon.nc",
"http://cygwin.mbwarez.dk/.netin/",
"http://cygwin.mbwarez.dk/.org/pub/cyQi",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk///in//",
"http://cygwin.mbwarez.dk//0",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin//",
"http://cygwin.mbwarez.dk//cygwin//;k",
"http://cygwin.mbwarez.dk//cygwin//Kon",
"http://cygwin.mbwarez.dk//cygwin/an",
"http://cygwin.mbwarez.dk//cygwin/etrceware.mirror.gar",
"http://cygwin.mbwarez.dk//cygwin/tvD",
"http://cygwin.mbwarez.dk//cygwin32/",
"http://cygwin.mbwarez.dk//cygwin32/;",
"http://cygwin.mbwarez.dk//in/",
"http://cygwin.mbwarez.dk//in/S",
"http://cygwin.mbwarez.dk//in/n/ftYR",
"http://cygwin.mbwarez.dk//n/in//",
"http://cygwin.mbwarez.dk//n/n/://",
"http://cygwin.mbwarez.dk//n/or.dat",
"http://cygwin.mbwarez.dk//pub/cygwin/&Dz",
"http://cygwin.mbwarez.dk//pub/cygwin/Er",
"http://cygwin.mbwarez.dk//pub/cygwingS",
"http://cygwin.mbwarez.dk//q",
"http://cygwin.mbwarez.dk//so.net/",
"http://cygwin.mbwarez.dk//win/",
"http://cygwin.mbwarez.dk//win/2/SL",
"http://cygwin.mbwarez.dk/0",
"http://cygwin.mbwarez.dk/1",
"http://cygwin.mbwarez.dk/3.compj",
"http://cygwin.mbwarez.dk/5",
"http://cygwin.mbwarez.dk/9E",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/;k",
"http://cygwin.mbwarez.dk/Asiayq",
"http://cygwin.mbwarez.dk/D",
"http://cygwin.mbwarez.dk/Q",
"http://cygwin.mbwarez.dk/Taiwan/dq",
"http://cygwin.mbwarez.dk/UD",
"http://cygwin.mbwarez.dk/achen.de",
"http://cygwin.mbwarez.dk/agata-u.ac.jp",
"http://cygwin.mbwarez.dk/are.mirror.gar",
"http://cygwin.mbwarez.dk/argasso.net/=x",
"http://cygwin.mbwarez.dk/b-",
"http://cygwin.mbwarez.dk/b/cygwin/com",
"http://cygwin.mbwarez.dk/b/cygwin/ogad/l",
"http://cygwin.mbwarez.dk/boa.pt/u",
"http://cygwin.mbwarez.dk/caks",
"http://cygwin.mbwarez.dk/cn/cygwin/",
"http://cygwin.mbwarez.dk/cn/cygwin/L_",
"http://cygwin.mbwarez.dk/com/cygwin/",
"http://cygwin.mbwarez.dk/cyg",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin/-D",
"http://cygwin.mbwarez.dk/cygwin/.Q",
"http://cygwin.mbwarez.dk/cygwin//",
"http://cygwin.mbwarez.dk/cygwin/2/",
"http://cygwin.mbwarez.dk/cygwin/SY",
"http://cygwin.mbwarez.dk/cygwin/d_",
"http://cygwin.mbwarez.dk/cygwin/eA",
"http://cygwin.mbwarez.dk/cygwin/gwin/gm",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/n//wd",
"http://cygwin.mbwarez.dk/cygwin/n/t_L",
"http://cygwin.mbwarez.dk/cygwin/s",
"http://cygwin.mbwarez.dk/cygwin/ttp",
"http://cygwin.mbwarez.dk/cygwin32/",
"http://cygwin.mbwarez.dk/d.comin/f/",
"http://cygwin.mbwarez.dk/d.coms.org//",
"http://cygwin.mbwarez.dk/deso.net//Vj(",
"http://cygwin.mbwarez.dk/domain.de/cygw",
"http://cygwin.mbwarez.dk/e",
"http://cygwin.mbwarez.dk/e/cygwin/",
"http://cygwin.mbwarez.dk/e/cygwin//",
"http://cygwin.mbwarez.dk/e/cygwin/tnlHf",
"http://cygwin.mbwarez.dk/easyname.at",
"http://cygwin.mbwarez.dk/ebsd.orgn.nc/yZ",
"http://cygwin.mbwarez.dk/ecygwin//",
"http://cygwin.mbwarez.dk/edu.cn",
"http://cygwin.mbwarez.dk/einrausch.de",
"http://cygwin.mbwarez.dk/et/cygwin//esW",
"http://cygwin.mbwarez.dk/et/cygwin//wL",
"http://cygwin.mbwarez.dk/et/cygwin/or/cygwin/n///GY",
"http://cygwin.mbwarez.dk/et/cygwin/z.d",
"http://cygwin.mbwarez.dk/etom/m",
"http://cygwin.mbwarez.dk/etworks.org/Y",
"http://cygwin.mbwarez.dk/etworks.org0i",
"http://cygwin.mbwarez.dk/g/cygwin/",
"http://cygwin.mbwarez.dk/g/cygwin//",
"http://cygwin.mbwarez.dk/g/cygwin//Yt",
"http://cygwin.mbwarez.dk/gata-u",
"http://cygwin.mbwarez.dk/gie.fr",
"http://cygwin.mbwarez.dk/goon.nc/",
"http://cygwin.mbwarez.dk/gwin/in/",
"http://cygwin.mbwarez.dk/gwin/m/",
"http://cygwin.mbwarez.dk/gwin/n/",
"http://cygwin.mbwarez.dk/gwin/win/",
"http://cygwin.mbwarez.dk/h.de",
"http://cygwin.mbwarez.dk/ia$",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in/.freebs",
"http://cygwin.mbwarez.dk/in/.hutLZ",
"http://cygwin.mbwarez.dk/in//",
"http://cygwin.mbwarez.dk/in//n/s",
"http://cygwin.mbwarez.dk/in/=A",
"http://cygwin.mbwarez.dk/in/enter.",
"http://cygwin.mbwarez.dk/in/gwin/",
"http://cygwin.mbwarez.dk/in/in/",
"http://cygwin.mbwarez.dk/in/in/GY",
"http://cygwin.mbwarez.dk/in/n//",
"http://cygwin.mbwarez.dk/in/n///miTW4",
"http://cygwin.mbwarez.dk/in/n/h_P",
"http://cygwin.mbwarez.dk/in/ong",
"http://cygwin.mbwarez.dk/in/rror.chi",
"http://cygwin.mbwarez.dk/in/ttp://siC",
"http://cygwin.mbwarez.dk/in/ygwin///wqCX",
"http://cygwin.mbwarez.dk/ina",
"http://cygwin.mbwarez.dk/l/pub/cygwi",
"http://cygwin.mbwarez.dk/mirror.dogado..C",
"http://cygwin.mbwarez.dk/n.uib.no//",
"http://cygwin.mbwarez.dk/n/",
"http://cygwin.mbwarez.dk/n/cygwin/a/",
"http://cygwin.mbwarez.dk/n/gwin/",
"http://cygwin.mbwarez.dk/n/win/kY0",
"http://cygwin.mbwarez.dk/n/win32/",
"http://cygwin.mbwarez.dk/no/",
"http://cygwin.mbwarez.dk/nu",
"http://cygwin.mbwarez.dk/o",
"http://cygwin.mbwarez.dk/om/cygwin/",
"http://cygwin.mbwarez.dk/omin/gwin/",
"http://cygwin.mbwarez.dk/orks.netn//kpAm",
"http://cygwin.mbwarez.dk/p",
"http://cygwin.mbwarez.dk/pub/software/c",
"http://cygwin.mbwarez.dk/rg/cygwin/",
"http://cygwin.mbwarez.dk/rgasso.net/",
"http://cygwin.mbwarez.dk/rgasso.net/e2h",
"http://cygwin.mbwarez.dk/rgasso.net/fZj",
"http://cygwin.mbwarez.dk/rks.orgboc",
"http://cygwin.mbwarez.dk/ror/cygwin//"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "238"
},
{
"description": "Uses secure TLS version for HTTPS connections",
"match_data": [
"8.43.85.97:443 -> 192.168.2.9:49738 version: TLS 1.2"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "7058"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"HTTP traffic on port 49712 -> 443",
"HTTP traffic on port 443 -> 49712"
],
"id": "625",
"description": "Uses HTTPS"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"refs": [
{
"ref": "#memory_dumps",
"value": "executable.exe, 00000000.00000002.4517172722.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, executable.exe, 00000000.00000002.4516435918.0000000000D18000.00000004.00000020.00020000.00000000.sdmp"
}
],
"match_data": [
"Hyper-V RAW"
],
"id": "263",
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mirror.constant.com/;cygwin.mirror.constant.com;North",
"http://cygwin.mirror.globo.tech/;cygwin.mirror.globo.tech;North",
"http://cygwin.mirror.rafal.ca/;cygwin.mirror.rafal.ca;North",
"http://cygwin.mirror.uk.sargasso.net/;cygwin.mirror.uk.sargasso.net;Europe;UK;noshow",
"http://cygwin.mirrors.hoobly.com/;cygwin.mirrors.hoobly.com;North",
"http://cygwin.osuosl.org/;cygwin.osuosl.org;North",
"http://cygwin.uib.no/;cygwin.uib.no;Europe;Norway;noshow",
"http://cygwin.viem-it.no/;cygwin.viem-it.no;Europe;Norway;noshow",
"http://download.nus.edu.sg/mirror/cygwin/;download.nus.edu.sg;Asia;Singapore;noshow",
"http://ftp-stud.hs-esslingen.de/pub/Mirrors/sources.redhat.com/cygwin/;ftp-stud.hs-esslingen.de;Euro",
"http://ftp.acc.umu.se/mirror/cygwin/;ftp.acc.umu.se;Europe;Sweden;noshow",
"http://ftp.byfly.by/pub/cygwin/;ftp.byfly.by;Europe;Belarus;noshow",
"http://ftp.eq.uc.pt/software/pc/prog/cygwin/;ftp.eq.uc.pt;Europe;Portugal;noshow",
"http://ftp.fau.de/cygwin/;ftp.fau.de;Europe;Germany;noshow",
"http://ftp.fsn.hu/pub/cygwin/;ftp.fsn.hu;Europe;Hungary;noshow",
"http://ftp.iij.ad.jp/pub/cygwin/;ftp.iij.ad.jp;Asia;Japan;noshow",
"http://ftp.inf.tu-dresden.de/software/windows/cygwin32/;ftp.inf.tu-dresden.de;Europe;Germany;noshow",
"http://ftp.is.co.za/mirrors/cygwin/;ftp.is.co.za;Africa;South",
"http://ftp.jaist.ac.jp/pub/cygwin/;ftp.jaist.ac.jp;Asia;Japan;noshow",
"http://ftp.lip6.fr/pub/cygwin/;ftp.lip6.fr;Europe;France;noshow",
"http://ftp.ntu.edu.tw/pub/cygwin/;ftp.ntu.edu.tw;Asia;Taiwan;noshow",
"http://ftp.ntua.gr/pub/pc/cygwin/;ftp.ntua.gr;Europe;Greece",
"http://ftp.rnl.tecnico.ulisboa.pt/pub/cygwin/;ftp.rnl.tecnico.ulisboa.pt;Europe;Portugal;noshow",
"http://ftp.snt.utwente.nl/pub/software/cygwin/;ftp.snt.utwente.nl;Europe;Netherlands;noshow",
"http://ftp.twaren.net/Unix/sourceware.org/cygwin/;ftp.twaren.net;Asia;Taiwan",
"http://ftp.yz.yamagata-u.ac.jp/pub/cygwin/;ftp.yz.yamagata-u.ac.jp;Asia;Japan;noshow",
"http://linorg.usp.br/cygwin/;linorg.usp.br;Latin",
"http://linux.rz.ruhr-uni-bochum.de/download/cygwin/;linux.rz.ruhr-uni-bochum.de;Europe;Germany;nosho",
"http://mirror-hk.koddos.net/cygwin/;mirror-hk.koddos.net;Asia;Hong",
"http://mirror.aarnet.edu.au/pub/sourceware/cygwin/;mirror.aarnet.edu.au;Australasia;Australia;noshow",
"http://mirror.checkdomain.de/cygwin/;mirror.checkdomain.de;Europe;Germany;noshow",
"http://mirror.clarkson.edu/cygwin/;mirror.clarkson.edu;North",
"http://mirror.cs.vt.edu/pub/cygwin/cygwin/;mirror.cs.vt.edu;North",
"http://mirror.csclub.uwaterloo.ca/cygwin/;mirror.csclub.uwaterloo.ca;North",
"http://mirror.datacenter.by/pub/mirrors/cygwin/;mirror.datacenter.by;Europe;Belarus;noshow",
"http://mirror.easyname.at/cygwin/;mirror.easyname.at;Europe;Austria;noshow",
"http://mirror.internode.on.net/pub/cygwin/;mirror.internode.on.net;Australasia;Australia",
"http://mirror.isoc.org.il/pub/cygwin/;mirror.isoc.org.il;Asia;Israel;noshow",
"http://mirror.koddos.net/cygwin/;mirror.koddos.net;Europe;Netherlands;noshow",
"http://mirror.lagoon.nc/cygwin/;mirror.lagoon.nc;Australasia;New",
"http://mirror.rise.ph/cygwin/cygwin/;mirror.rise.ph;Asia;Philippines",
"http://mirror.steadfast.net/cygwin/;mirror.steadfast.net;North",
"http://mirror.team-cymru.com/cygwin/;mirror.team-cymru.com;North",
"http://mirror.terrahost.no/cygwin/;mirror.terrahost.no;Europe;Norway;noshow",
"http://mirrors.163.com/cygwin/;mirrors.163.com;Asia;China;noshow",
"http://mirrors.dotsrc.org/cygwin/;mirrors.dotsrc.org;Europe;Denmark;noshow",
"http://mirrors.kernel.org/sourceware/cygwin/;mirrors.kernel.org;North",
"http://mirrors.netix.net/cygwin/;mirrors.netix.net;Europe;Bulgaria;noshow",
"http://mirrors.neusoft.edu.cn/cygwin/;mirrors.neusoft.edu.cn;Asia;China;noshow",
"http://mirrors.sonic.net/cygwin/;mirrors.sonic.net;North",
"http://mirrors.syringanetworks.net/cygwin/;mirrors.syringanetworks.net;North",
"http://mirrors.ustc.edu.cn/cygwin/;mirrors.ustc.edu.cn;Asia;China;noshow",
"http://mirrors.xmission.com/cygwin/;mirrors.xmission.com;North",
"http://muug.ca/mirror/cygwin/;muug.ca;North",
"http://r3.i.lencr.org",
"http://r3.i.lencr.org/0M",
"http://r3.o.lencr.org0",
"http://sourceware.mirror.garr.it/cygwin/;sourceware.mirror.garr.it;Europe;Italy;noshow",
"http://ucmirror.canterbury.ac.nz/cygwin/;ucmirror.canterbury.ac.nz;Australasia;New",
"http://www.gtlib.gatech.edu/pub/cygwin/;www.gtlib.gatech.edu;North",
"http://www.gutscheinrausch.de/mirror/cygwin/;www.gutscheinrausch.de;Europe;Germany;noshow",
"http://www.mirrorservice.org/sites/sourceware.org/pub/cygwin/;www.mirrorservice.org;Europe;UK;noshow",
"http://x1.c.lencr.org/0",
"http://x1.i.lencr.org/0",
"https://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway",
"https://cygwin.com",
"https://cygwin.com/W",
"https://cygwin.com/mirrors.lst",
"https://cygwin.com/mirrors.lst4",
"https://cygwin.com/mirrors.lst8",
"https://cygwin.com/mirrors.lstDefaulting",
"https://cygwin.com/mirrors.lstce",
"https://cygwin.com/mirrors.lstdll",
"https://cygwin.com/mirrors.lstlF",
"https://cygwin.com/mirrors.lstll",
"https://cygwin.com/mirrors.lstystem32",
"https://cygwin.com/setup-%s.exe",
"https://cygwin.com/setup-%s.exeThe",
"https://cygwin.com/setup-%s.exe_self-destructlibsolv-self-destruct-pkg()basic_string::append-srczstx",
"https://cygwin.com/t",
"https://cygwin.com9",
"https://cygwin.comzstxzbz2inibasic_string::_M_construct",
"https://cygwin.itefix.net/;cygwin.itefix.net;Europe;Germany",
"https://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark",
"https://cygwin.mirror.constant.com/;cygwin.mirror.constant.com;North",
"https://cygwin.mirror.globo.tech/;cygwin.mirror.globo.tech;North",
"https://cygwin.mirror.uk.sargasso.net/;cygwin.mirror.uk.sargasso.net;Europe;UK",
"https://cygwin.mirrors.hoobly.com/;cygwin.mirrors.hoobly.com;North",
"https://cygwin.osuosl.org/;cygwin.osuosl.org;North",
"https://cygwin.uib.no/;cygwin.uib.no;Europe;Norway",
"https://cygwin.viem-it.no/;cygwin.viem-it.no;Europe;Norway",
"https://download.nus.edu.sg/mirror/cygwin/;download.nus.edu.sg;Asia;Singapore",
"https://ftp-stud.hs-esslingen.de/pub/Mirrors/sources.redhat.com/cygwin/;ftp-stud.hs-esslingen.de;Eur",
"https://ftp.acc.umu.se/mirror/cygwin/;ftp.acc.umu.se;Europe;Sweden",
"https://ftp.byfly.by/pub/cygwin/;ftp.byfly.by;Europe;Belarus",
"https://ftp.eq.uc.pt/software/pc/prog/cygwin/;ftp.eq.uc.pt;Europe;Portugal",
"https://ftp.fau.de/cygwin/;ftp.fau.de;Europe;Germany",
"https://ftp.fsn.hu/pub/cygwin/;ftp.fsn.hu;Europe;Hungary",
"https://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/;ftp.funet.fi;Europe;Finland",
"https://ftp.halifax.rwth-aachen.de/cygwin/;ftp.halifax.rwth-aachen.de;Europe;Germany",
"https://ftp.iij.ad.jp/pub/cygwin/;ftp.iij.ad.jp;Asia;Japan",
"https://ftp.inf.tu-dresden.de/software/windows/cygwin32/;ftp.inf.tu-dresden.de;Europe;Germany",
"https://ftp.jaist.ac.jp/pub/cygwin/;ftp.jaist.ac.jp;Asia;Japan",
"https://ftp.kaist.ac.kr/cygwin/;ftp.kaist.ac.kr;Asia;Korea",
"https://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/;ftp.kr.freebsd.org;Asia;Korea",
"https://ftp.lip6.fr/pub/cygwin/;ftp.lip6.fr;Europe;France",
"https://ftp.ntu.edu.tw/pub/cygwin/;ftp.ntu.edu.tw;Asia;Taiwan",
"https://ftp.rnl.tecnico.ulisboa.pt/pub/cygwin/;ftp.rnl.tecnico.ulisboa.pt;Europe;Portugal",
"https://ftp.snt.utwente.nl/pub/software/cygwin/;ftp.snt.utwente.nl;Europe;Netherlands",
"https://ftp.yz.yamagata-u.ac.jp/pub/cygwin/;ftp.yz.yamagata-u.ac.jp;Asia;Japan",
"https://gnu.org/licenses/",
"https://gnu.org/licenses/gpl.html",
"https://linorg.usp.br/cygwin/;linorg.usp.br;Latin",
"https://linux.rz.ruhr-uni-bochum.de/download/cygwin/;linux.rz.ruhr-uni-bochum.de;Europe;Germany",
"https://mirror-hk.koddos.net/cygwin/;mirror-hk.koddos.net;Asia;Hong",
"https://mirror.aarnet.edu.au/pub/sourceware/cygwin/;mirror.aarnet.edu.au;Australasia;Australia",
"https://mirror.checkdomain.de/cygwin/;mirror.checkdomain.de;Europe;Germany",
"https://mirror.clarkson.edu/cygwin/;mirror.clarkson.edu;North",
"https://mirror.clientvps.com/cygwin/;mirror.clientvps.com;Europe;Germany",
"https://mirror.csclub.uwaterloo.ca/cygwin/;mirror.csclub.uwaterloo.ca;North",
"https://mirror.datacenter.by/pub/mirrors/cygwin/;mirror.datacenter.by;Europe;Belarus",
"https://mirror.dogado.de/cygwin/;mirror.dogado.de;Europe;Germany",
"https://mirror.easyname.at/cygwin/;mirror.easyname.at;Europe;Austria",
"https://mirror.isoc.org.il/pub/cygwin/;mirror.isoc.org.il;Asia;Israel",
"https://mirror.koddos.net/cygwin/;mirror.koddos.net;Europe;Netherlands",
"https://mirror.lagoon.nc/cygwin/;mirror.lagoon.nc;Australasia;New",
"https://mirror.mangohost.net/cygwin/;mirror.mangohost.net;Europe;Moldova",
"https://mirror.steadfast.net/cygwin/;mirror.steadfast.net;North",
"https://mirror.terrahost.no/cygwin/;mirror.terrahost.no;Europe;Norway",
"https://mirrors.163.com/cygwin/;mirrors.163.com;Asia;China",
"https://mirrors.163.comhttps://mirrors.aliyun.comhttps://mirror.clientvps.comhttps://cygwin.mirror.c",
"https://mirrors.aliyun.com/cygwin/;mirrors.aliyun.com;Asia;China",
"https://mirrors.aliyun.comhttps://mirror.clientvps.comhttps://cygwin.mirror.constant.comhttps://poli",
"https://mirrors.dotsrc.org/cygwin/;mirrors.dotsrc.org;Europe;Denmark",
"https://mirrors.filigrane-technologie.fr/cygwin/;mirrors.filigrane-technologie.fr;Europe;France",
"https://mirrors.huaweicloud.com/cygwin/;mirrors.huaweicloud.com;Asia;China",
"https://mirrors.kernel.org/sourceware/cygwin/;mirrors.kernel.org;North",
"https://mirrors.netix.net/cygwin/;mirrors.netix.net;Europe;Bulgaria",
"https://mirrors.neusoft.edu.cn/cygwin/;mirror7",
"https://mirrors.neusoft.edu.cn/cygwin/;mirrors.neusoft.edu.cn;Asia;China",
"https://mirrors.rit.edu/cygwin/;mirrors.rit.edu;North",
"https://mirrors.sjtug.sjtu.edu.cn/cygwin/;mirrors.sjtug.sjtu.edu.cn;Asia;China",
"https://mirrors.sonic.net/cygwin/;mirrors.sonic.net;North",
"https://mirrors.tencent.com/cygwin/;mirrors.tencent.com;Asia;China",
"https://mirrors.ustc.edu.cn/cygwin/;mirrors.ustc.edu.cn;Asia;China",
"https://mirrors.xmission.com/cygwin/;mirrors.xmission.com;North",
"https://muug.ca/mirror/cygwin/;muug.ca;North",
"https://polish-mirror.evolution-host.com/cygwin/;polish-mirror.evolution-host.com;Europe;Poland",
"https://sourceware.mirror.garr.it/cygwin/;sourceware.mirror.garr.it;Europe;Italy",
"https://sunsite.icm.edu.pl/pub/cygnus/cygwin/;sunsite.icm.edu.pl;Europe;Poland",
"https://www.gutscheinrausch.de/mirror/cygwin/;www.gutscheinrausch.de;Europe;Germany",
"https://www.mirrorservice.org",
"https://www.mirrorservice.org/sites/sourceware.org/pub/cygwin/;www.mirrorservice.org;Europe;UK"
],
"id": "238",
"description": "URLs found in memory or binary data"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"8.43.85.97:443 -> 192.168.2.11:49712 version: TLS 1.2"
],
"id": "7058",
"description": "Uses secure TLS version for HTTPS connections"
},
{
"id": "625",
"match_data": [
"HTTP traffic on port 49713 -> 443",
"HTTP traffic on port 443 -> 49713"
],
"description": "Uses HTTPS",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "263",
"refs": [
{
"ref": "#memory_dumps",
"value": "software.exe, 00000000.00000002.4601502652.0000000000C2F000.00000004.00000020.00020000.00000000.sdmp"
},
{
"ref": "#memory_dumps",
"value": "software.exe, 00000000.00000002.4601906974.0000000000C85000.00000004.00000020.00020000.00000000.sdmp"
}
],
"match_data": [
"Hyper-V RAW0",
"Hyper-V RAW"
],
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "238",
"match_data": [
"ftp://cygwin.mirror.rafal.cars",
"ftp://ftp-stud.hs-esslingen.dem",
"ftp://ftp.2g?",
"ftp://ftp.byfly.by/pub/cyg",
"ftp://ftp.byfly.by/pub/cyg%",
"ftp://ftp.byfly.by/pub/cygwin/",
"ftp://ftp.byfly.by/pub/cygwin/http://dOf",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/p",
"ftp://ftp.fs",
"ftp://ftp.fsn.hu/pub/cygwin/p",
"ftp://ftp.fsn.hu/pub/cygwin/tp",
"ftp://ftp.fsn.hut",
"ftp://ftp.ha",
"ftp://ftp.haA",
"ftp://ftp.iij.ad.jp/pub/cygwin/",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://mOg",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://m_~",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://w",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.iij.ad.jp/pub/cygwin/n",
"ftp://ftp.iij.ad.jp/pub/cygwin/or",
"ftp://ftp.inf.tu-dresden.de",
"ftp://ftp.inf.tu-dresden.de.jpor",
"ftp://ftp.inf.tu-dresden.degwin/",
"ftp://ftp.inf.tu-dresden.degwin/http:/",
"ftp://ftp.kaist.ac.kr/cygwin/",
"ftp://ftp.kaist.ac.kr/cygwin/win",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://m",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://",
"ftp://ftp.kr.freebsd.orgftp",
"ftp://ftp.l",
"ftp://ftp.lip6.fr/pub/cygwin/",
"ftp://ftp.lip6.fr/pub/cygwin/or",
"ftp://ftp.mirrorservice.orgin/r",
"ftp://ftp.muug.ca/mirror/cygwin//https://",
"ftp://ftp.muug.ca/mirror/cygwin/e",
"ftp://ftp.n_db",
"ftp://ftp.ntua.gr/pub/pc/cygwin/https://",
"ftp://ftp.ntua.gr/pub/pc/cygwin/r",
"ftp://ftp.snt.utwente.nl",
"ftp://ftp.snt.utwente.nl/pub/software/cygwin/https://",
"ftp://ftp.yz.yamagata-u.ac.jp",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/",
"ftp://ftp.yz.yamagata-u.ac.jprs",
"ftp://linux.rz.ruhr-uni-bochum.de",
"ftp://linux.rz.ruhr-uni-bochum.de/cygwin/ustc",
"ftp://linux.rz.ruhr-uni-bochum.de/http",
"ftp://mirror.checkdomain.de",
"ftp://mirror.checkdomain.de/cygwi(",
"ftp://mirror.checkdomain.de/cygwin/",
"ftp://mirror.checkdomain.de/cygwin/cygwin",
"ftp://mirror.checkdomain.de/cygwin/p",
"ftp://mirror.checkdomain.detp",
"ftp://mirror.checkdomain.deunsite",
"ftp://mirror.cs.vt.edu/pub/cygwin/cygwin/",
"ftp://mirror.cs.vt.edu/pub/cygwin/cygwin/p",
"ftp://mirror.csclub.uwaterloo.ca/cygwin/oc",
"ftp://mirror.datacenter.byirror",
"ftp://mirror.easyname.attp",
"ftp://mirror.easyname.atygwin/http://f",
"ftp://mirror.internode.on.net/pub/cygwin/",
"ftp://mirror.internode.on.net/pub/cygwin/gwin/https://",
"ftp://mirror.internode.on.nethttp://dOf",
"ftp://mirror.internode.on.nethttp://ftp",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/ygwin",
"ftp://mirrors.netix.net/cygwin/http://fG",
"ftp://mirrors.netix.net/cygwin/http://w",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://f",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://m",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://w",
"ftp://sunsite.icm.edu.plg/cygwin/",
"ftp://sunsite.icm.edu.plix",
"ftp://sunsite.icm.edu.plygwin",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org#",
"http://cps.root-x1.letsencrypt.org0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://cygwin.cathedral-",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org.fs",
"http://cygwin.cathedral-networks.org.ne",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/$z",
"http://cygwin.cathedral-networks.org/&",
"http://cygwin.cathedral-networks.org/&f",
"http://cygwin.cathedral-networks.org/(",
"http://cygwin.cathedral-networks.org/.9c",
"http://cygwin.cathedral-networks.org/.f",
"http://cygwin.cathedral-networks.org/.mwi",
"http://cygwin.cathedral-networks.org/.o6g;",
"http://cygwin.cathedral-networks.org/.t",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org///7f",
"http://cygwin.cathedral-networks.org///tbF",
"http://cygwin.cathedral-networks.org//;",
"http://cygwin.cathedral-networks.org//E",
"http://cygwin.cathedral-networks.org//Feu",
"http://cygwin.cathedral-networks.org//G",
"http://cygwin.cathedral-networks.org//cU",
"http://cygwin.cathedral-networks.org//do",
"http://cygwin.cathedral-networks.org//ftp.is.co.za/mirrors/cygwin/et#f",
"http://cygwin.cathedral-networks.org//jJ",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org//mFx",
"http://cygwin.cathedral-networks.org//y",
"http://cygwin.cathedral-networks.org/:",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/;e",
"http://cygwin.cathedral-networks.org/=",
"http://cygwin.cathedral-networks.org/=x",
"http://cygwin.cathedral-networks.org/?b",
"http://cygwin.cathedral-networks.org/He",
"http://cygwin.cathedral-networks.org/I",
"http://cygwin.cathedral-networks.org/J",
"http://cygwin.cathedral-networks.org/Jx",
"http://cygwin.cathedral-networks.org/Le",
"http://cygwin.cathedral-networks.org/N",
"http://cygwin.cathedral-networks.org/P",
"http://cygwin.cathedral-networks.org/Pek",
"http://cygwin.cathedral-networks.org/Re",
"http://cygwin.cathedral-networks.org/Rh",
"http://cygwin.cathedral-networks.org/U",
"http://cygwin.cathedral-networks.org/Vq",
"http://cygwin.cathedral-networks.org/W",
"http://cygwin.cathedral-networks.org/Y",
"http://cygwin.cathedral-networks.org/ac",
"http://cygwin.cathedral-networks.org/bdl",
"http://cygwin.cathedral-networks.org/c",
"http://cygwin.cathedral-networks.org/co",
"http://cygwin.cathedral-networks.org/cr",
"http://cygwin.cathedral-networks.org/cy",
"http://cygwin.cathedral-networks.org/cy$b",
"http://cygwin.cathedral-networks.org/dJ",
"http://cygwin.cathedral-networks.org/ed",
"http://cygwin.cathedral-networks.org/ed3",
"http://cygwin.cathedral-networks.org/ee",
"http://cygwin.cathedral-networks.org/f",
"http://cygwin.cathedral-networks.org/fgs",
"http://cygwin.cathedral-networks.org/ft",
"http://cygwin.cathedral-networks.org/ht",
"http://cygwin.cathedral-networks.org/i",
"http://cygwin.cathedral-networks.org/ia",
"http://cygwin.cathedral-networks.org/in",
"http://cygwin.cathedral-networks.org/inKb",
"http://cygwin.cathedral-networks.org/irrors/cygwin/n/",
"http://cygwin.cathedral-networks.org/it",
"http://cygwin.cathedral-networks.org/j",
"http://cygwin.cathedral-networks.org/ka",
"http://cygwin.cathedral-networks.org/ky",
"http://cygwin.cathedral-networks.org/l",
"http://cygwin.cathedral-networks.org/mi",
"http://cygwin.cathedral-networks.org/n/",
"http://cygwin.cathedral-networks.org/n5g",
"http://cygwin.cathedral-networks.org/ne",
"http://cygwin.cathedral-networks.org/niJg",
"http://cygwin.cathedral-networks.org/nl",
"http://cygwin.cathedral-networks.org/of",
"http://cygwin.cathedral-networks.org/olx",
"http://cygwin.cathedral-networks.org/oo",
"http://cygwin.cathedral-networks.org/osHy",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/ps",
"http://cygwin.cathedral-networks.org/r(c",
"http://cygwin.cathedral-networks.org/ra",
"http://cygwin.cathedral-networks.org/rahost",
"http://cygwin.cathedral-networks.org/rs",
"http://cygwin.cathedral-networks.org/s.",
"http://cygwin.cathedral-networks.org/s:",
"http://cygwin.cathedral-networks.org/stMy",
"http://cygwin.cathedral-networks.org/su",
"http://cygwin.cathedral-networks.org/teiy",
"http://cygwin.cathedral-networks.org/tp",
"http://cygwin.cathedral-networks.org/tpzb",
"http://cygwin.cathedral-networks.org/w",
"http://cygwin.cathedral-networks.org/xeS",
"http://cygwin.cathedral-networks.org/xzS",
"http://cygwin.cathedral-networks.org/yg",
"http://cygwin.cathedral-networks.org/~",
"http://cygwin.cathedral-networks.org8",
"http://cygwin.cathedral-networks.orgCe",
"http://cygwin.cathedral-networks.orgI",
"http://cygwin.cathedral-networks.orgJet",
"http://cygwin.cathedral-networks.orgM",
"http://cygwin.cathedral-networks.orgMi",
"http://cygwin.cathedral-networks.orgMz",
"http://cygwin.cathedral-networks.orgOeq",
"http://cygwin.cathedral-networks.orgW",
"http://cygwin.cathedral-networks.orgZ",
"http://cygwin.cathedral-networks.orgate",
"http://cygwin.cathedral-networks.orgbx",
"http://cygwin.cathedral-networks.orgcygxbR",
"http://cygwin.cathedral-networks.orgd",
"http://cygwin.cathedral-networks.orger.",
"http://cygwin.cathedral-networks.orgn",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgn/o",
"http://cygwin.cathedral-networks.orgnetVy",
"http://cygwin.cathedral-networks.orgq",
"http://cygwin.cathedral-networks.orgr.c",
"http://cygwin.cathedral-networks.orgror",
"http://cygwin.cathedral-networks.orgstc",
"http://cygwin.cathedral-networks.orgt.",
"http://cygwin.cathedral-networks.orgte.",
"http://cygwin.cathedral-networks.orguts",
"http://cygwin.cathedral-networks.orgvfI",
"http://cygwin.cathedral-networks.orgx",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk-bochum.de",
"http://cygwin.mbwarez.dk.byn/c.pteIx",
"http://cygwin.mbwarez.dk.de/cygwin/e",
"http://cygwin.mbwarez.dk.dein/",
"http://cygwin.mbwarez.dk.den/win//",
"http://cygwin.mbwarez.dk.deork-0",
"http://cygwin.mbwarez.dk.fsn.hufr",
"http://cygwin.mbwarez.dk.halifax.rwth-a",
"http://cygwin.mbwarez.dk.kaist.ac.krmPz",
"http://cygwin.mbwarez.dk.netom/cygwin",
"http://cygwin.mbwarez.dk.orgks.org",
"http://cygwin.mbwarez.dk.orgygwin/",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/#",
"http://cygwin.mbwarez.dk/(o",
"http://cygwin.mbwarez.dk/)",
"http://cygwin.mbwarez.dk/.",
"http://cygwin.mbwarez.dk/.ad.jpjp",
"http://cygwin.mbwarez.dk/.cah.de",
"http://cygwin.mbwarez.dk/.cnpt$q",
"http://cygwin.mbwarez.dk/.comin/3",
"http://cygwin.mbwarez.dk/.de//:d",
"http://cygwin.mbwarez.dk/.de/ia",
"http://cygwin.mbwarez.dk/.dede/t/Ve",
"http://cygwin.mbwarez.dk/.degwin//3g",
"http://cygwin.mbwarez.dk/.desso.net/",
"http://cygwin.mbwarez.dk/.hu/pub/cyg",
"http://cygwin.mbwarez.dk/.il/pu",
"http://cygwin.mbwarez.dk/.twaren.net",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk//.ruhr-uni",
"http://cygwin.mbwarez.dk///cygwin/",
"http://cygwin.mbwarez.dk///cygwin/4",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin//",
"http://cygwin.mbwarez.dk//cygwin///",
"http://cygwin.mbwarez.dk//cygwin/=aT",
"http://cygwin.mbwarez.dk//cygwin/T",
"http://cygwin.mbwarez.dk//cygwin/n/",
"http://cygwin.mbwarez.dk//cygwin/win/",
"http://cygwin.mbwarez.dk//gwin///f5eP",
"http://cygwin.mbwarez.dk//gwin/8g",
"http://cygwin.mbwarez.dk//in/",
"http://cygwin.mbwarez.dk//in/.com",
"http://cygwin.mbwarez.dk//in/comBy",
"http://cygwin.mbwarez.dk//pub/cygwin/",
"http://cygwin.mbwarez.dk//pub/m",
"http://cygwin.mbwarez.dk//wbx",
"http://cygwin.mbwarez.dk//win//",
"http://cygwin.mbwarez.dk//ygwin/",
"http://cygwin.mbwarez.dk//ygwin32/C",
"http://cygwin.mbwarez.dk/1",
"http://cygwin.mbwarez.dk/3",
"http://cygwin.mbwarez.dk/3.com",
"http://cygwin.mbwarez.dk/5",
"http://cygwin.mbwarez.dk/7",
"http://cygwin.mbwarez.dk/7b",
"http://cygwin.mbwarez.dk/7z",
"http://cygwin.mbwarez.dk/:",
"http://cygwin.mbwarez.dk/;",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/A",
"http://cygwin.mbwarez.dk/Australi",
"http://cygwin.mbwarez.dk/Chinaft",
"http://cygwin.mbwarez.dk/D",
"http://cygwin.mbwarez.dk/E",
"http://cygwin.mbwarez.dk/Europe",
"http://cygwin.mbwarez.dk/H",
"http://cygwin.mbwarez.dk/Moldova",
"http://cygwin.mbwarez.dk/N",
"http://cygwin.mbwarez.dk/North",
"http://cygwin.mbwarez.dk/P",
"http://cygwin.mbwarez.dk/R",
"http://cygwin.mbwarez.dk/ac.jpdk",
"http://cygwin.mbwarez.dk/acenter.by",
"http://cygwin.mbwarez.dk/acenter.by/",
"http://cygwin.mbwarez.dk/aist.ac.kr3c",
"http://cygwin.mbwarez.dk/aliP",
"http://cygwin.mbwarez.dk/ant.com/",
"http://cygwin.mbwarez.dk/au2",
"http://cygwin.mbwarez.dk/b/cygwin//os",
"http://cygwin.mbwarez.dk/b/cygwin/in",
"http://cygwin.mbwarez.dk/c.jp/pub/cygwinzw",
"http://cygwin.mbwarez.dk/cn",
"http://cygwin.mbwarez.dk/cn/cygwin/",
"http://cygwin.mbwarez.dk/cn/cygwin/)l",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin/.a",
"http://cygwin.mbwarez.dk/cygwin/.ch",
"http://cygwin.mbwarez.dk/cygwin/.d",
"http://cygwin.mbwarez.dk/cygwin//in/",
"http://cygwin.mbwarez.dk/cygwin//n/r",
"http://cygwin.mbwarez.dk/cygwin//pub/cOxw",
"http://cygwin.mbwarez.dk/cygwin/2z",
"http://cygwin.mbwarez.dk/cygwin/H",
"http://cygwin.mbwarez.dk/cygwin/ali",
"http://cygwin.mbwarez.dk/cygwin/in/",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/n/gf",
"http://cygwin.mbwarez.dk/cygwin/qd",
"http://cygwin.mbwarez.dk/cygwin/~",
"http://cygwin.mbwarez.dk/d",
"http://cygwin.mbwarez.dk/d.comin/Z",
"http://cygwin.mbwarez.dk/de/cygwin/",
"http://cygwin.mbwarez.dk/de/cygwin/:",
"http://cygwin.mbwarez.dk/de/cygwin/ny",
"http://cygwin.mbwarez.dk/dein//n/-f",
"http://cygwin.mbwarez.dk/e",
"http://cygwin.mbwarez.dk/e/cygwin//",
"http://cygwin.mbwarez.dk/e/software/win9f",
"http://cygwin.mbwarez.dk/en.de.orgJ",
"http://cygwin.mbwarez.dk/erloo.caz",
"http://cygwin.mbwarez.dk/et/cyg",
"http://cygwin.mbwarez.dk/et/cygwin/",
"http://cygwin.mbwarez.dk/et/cygwin/tsr",
"http://cygwin.mbwarez.dk/etworks.org/",
"http://cygwin.mbwarez.dk/etworks.org/3",
"http://cygwin.mbwarez.dk/fsn.hun.dem",
"http://cygwin.mbwarez.dk/ftp://linux",
"http://cygwin.mbwarez.dk/g/cygwin/",
"http://cygwin.mbwarez.dk/gwin",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin/32/g",
"http://cygwin.mbwarez.dk/gwin/A",
"http://cygwin.mbwarez.dk/gwin/n/nu",
"http://cygwin.mbwarez.dk/gwin/ware/winkg",
"http://cygwin.mbwarez.dk/gwin/win/",
"http://cygwin.mbwarez.dk/gwin/win//Eek",
"http://cygwin.mbwarez.dk/hen.dein/n/)y",
"http://cygwin.mbwarez.dk/ie.fr/",
"http://cygwin.mbwarez.dk/il",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in/.edu.pl",
"http://cygwin.mbwarez.dk/in/.org.ij",
"http://cygwin.mbwarez.dk/in/63.com",
"http://cygwin.mbwarez.dk/in/cygwin/",
"http://cygwin.mbwarez.dk/in/dxP",
"http://cygwin.mbwarez.dk/in/ervice.",
"http://cygwin.mbwarez.dk/in/gwin/Fd",
"http://cygwin.mbwarez.dk/in/in/",
"http://cygwin.mbwarez.dk/in/in/n/",
"http://cygwin.mbwarez.dk/in/jp",
"http://cygwin.mbwarez.dk/in/l.ca/cLo",
"http://cygwin.mbwarez.dk/in/n/",
"http://cygwin.mbwarez.dk/in/n///",
"http://cygwin.mbwarez.dk/in/n/in/s.",
"http://cygwin.mbwarez.dk/in/n/n/",
"http://cygwin.mbwarez.dk/in/n/qy",
"http://cygwin.mbwarez.dk/in/ropec",
"http://cygwin.mbwarez.dk/in/warez.d",
"http://cygwin.mbwarez.dk/in/win32/O",
"http://cygwin.mbwarez.dk/in/ygwin/qe",
"http://cygwin.mbwarez.dk/irror",
"http://cygwin.mbwarez.dk/irror-hk",
"http://cygwin.mbwarez.dk/m/cygwin/",
"http://cygwin.mbwarez.dk/m/cygwin/ata-",
"http://cygwin.mbwarez.dk/mirror",
"http://cygwin.mbwarez.dk/mirror.dogado.",
"http://cygwin.mbwarez.dk/mirrors.",
"http://cygwin.mbwarez.dk/n",
"http://cygwin.mbwarez.dk/n.dein/",
"http://cygwin.mbwarez.dk/n.dein/g/",
"http://cygwin.mbwarez.dk/n/",
"http://cygwin.mbwarez.dk/n//",
"http://cygwin.mbwarez.dk/n/05/",
"http://cygwin.mbwarez.dk/n/7",
"http://cygwin.mbwarez.dk/n/cygwin/",
"http://cygwin.mbwarez.dk/n/cygwin//",
"http://cygwin.mbwarez.dk/n/cygwin/0f",
"http://cygwin.mbwarez.dk/n/cygwin/Jhh",
"http://cygwin.mbwarez.dk/n/cygwin/free&g",
"http://cygwin.mbwarez.dk/n/gwin/or",
"http://cygwin.mbwarez.dk/n/in/",
"http://cygwin.mbwarez.dk/n/in/in/",
"http://cygwin.mbwarez.dk/n/n/E0",
"http://cygwin.mbwarez.dk/n/ygwin/",
"http://cygwin.mbwarez.dk/n/ygwin/=l",
"http://cygwin.mbwarez.dk/n/ygwin/sn",
"http://cygwin.mbwarez.dk/ncent.com",
"http://cygwin.mbwarez.dk/netwin/in/",
"http://cygwin.mbwarez.dk/no/cygwin/",
"http://cygwin.mbwarez.dk/no/cygwin/Ml",
"http://cygwin.mbwarez.dk/o",
"http://cygwin.mbwarez.dk/om/cygwin/",
"http://cygwin.mbwarez.dk/om/cygwin/G",
"http://cygwin.mbwarez.dk/org",
"http://cygwin.mbwarez.dk/org/n/=",
"http://cygwin.mbwarez.dk/owin/",
"http://cygwin.mbwarez.dk/p"
],
"description": "URLs found in memory or binary data",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "7058",
"match_data": [
"8.43.85.97:443 -> 192.168.2.10:49713 version: TLS 1.2"
],
"description": "Uses secure TLS version for HTTPS connections",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"description": "Uses HTTPS",
"match_data": [
"HTTP traffic on port 49728 -> 443",
"HTTP traffic on port 443 -> 49728"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "625"
},
{
"refs": [
{
"ref": "#memory_dumps",
"value": "software.exe, 00000001.00000002.4622195069.0000000000D18000.00000004.00000020.00020000.00000000.sdmp, software.exe, 00000001.00000002.4623016437.0000000000D68000.00000004.00000020.00020000.00000000.sdmp"
}
],
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)",
"match_data": [
"Hyper-V RAW"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "263"
},
{
"description": "URLs found in memory or binary data",
"match_data": [
"ftp://cygwin.mirror.rafal.ca/pub/cygwin/en",
"ftp://cygwin.mirror.rafal.ca/pub/cygwin/st",
"ftp://cygwin.mirror.rafal.cat",
"ftp://ftp.Q",
"ftp://ftp.byfly.by/pub/cygwin/https://f",
"ftp://ftp.byfly.by/pub/cygwin/in/",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://c",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/https://",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/https://;",
"ftp://ftp.fa",
"ftp://ftp.fau.de/cygwin/gen.dehttp://mm",
"ftp://ftp.fau.de/cygwin/ix",
"ftp://ftp.fau.de/cygwin/mirror",
"ftp://ftp.fs",
"ftp://ftp.fsj",
"ftp://ftp.fsn.hu/pub/cygwin/http://ftp.",
"ftp://ftp.halifax.rwth-aachen.de",
"ftp://ftp.halifax.rwth-aachen.de/",
"ftp://ftp.halifax.rwth-aachen.de/cygwin/ygwin/http://m",
"ftp://ftp.halifax.rwth-aachen.dehttps:/h2",
"ftp://ftp.iij.ad.jp/pub/cygwin/",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://fK",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://fu",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://m5",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.inf.tu-dresden.deygwin",
"ftp://ftp.kaist.ac.kr/cygwin/https://)",
"ftp://ftp.kaist.ac.kr/cygwin/rror",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://m",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://8",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://d",
"ftp://ftp.kr.freebsd.orgderors",
"ftp://ftp.lU/",
"ftp://ftp.lip6.fr/pub/cygwin/",
"ftp://ftp.lip6.fr/pub/cygwin/p",
"ftp://ftp.lip6.fr/pub/cygwin/win/http:",
"ftp://ftp.muug.ca/mirror/cygwin/in/",
"ftp://ftp.n",
"ftp://ftp.ntua.gr",
"ftp://ftp.rnl.tecnico.ulisboa.pt/http:",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/",
"ftp://ftp.yz.yamagata-u.ac.jphttps://)",
"ftp://linux.rz.ruhr-uni-bochum.de",
"ftp://linux.rz.ruhr-uni-bochum.dehttps:",
"ftp://mirror.checkdomain.de/cygwin/http",
"ftp://mirror.cs.vt.edu/pub/cygwin/cygwin//http",
"ftp://mirror.csclub.uwaterlo",
"ftp://mirror.datacenter.by/http://ftp.",
"ftp://mirror.datacenter.bytechor",
"ftp://mirror.easyname.at/cygwin/http://m",
"ftp://mirror.easyname.attp",
"ftp://mirror.internode.on.net",
"ftp://mirror.internode.on.neters",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/st",
"ftp://mirrors.netix.net/cygwin/",
"ftp://mirrors.netix.net/cygwin/http://f",
"ftp://mirrors.netix.net/cygwin/https://",
"ftp://mirrors.syringanetworks.net/cygwin/",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://l",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/in/https://C",
"ftp://sunsite.icm.edu.plygwin",
"http://ac.economia.gob.mx/cps.html0",
"http://ac.economia.gob.mx/last.crl0G",
"http://acedicom.edicomgroup.com/doc0",
"http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?",
"http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0",
"http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://ca.disig.sk/ca/crl/ca_disig.crl0",
"http://ca.mtin.es/mtin/DPCyPoliticas0",
"http://ca.mtin.es/mtin/DPCyPoliticas0g",
"http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03",
"http://ca.mtin.es/mtin/ocsp0",
"http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0",
"http://certificates.starfieldtech.com/repository/1604",
"http://certs.oati.net/repository/OATICA2.crl0",
"http://certs.oati.net/repository/OATICA2.crt0",
"http://certs.oaticerts.com/repository/OATICA2.crl",
"http://certs.oaticerts.com/repository/OATICA2.crt08",
"http://cps.chambersign.org/cps/chambersignroot.html0",
"http://cps.chambersign.org/cps/chambersroot.html0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://cps.siths.se/sithsrootcav1.html0",
"http://crl.certigna.fr/certignarootca.crl01",
"http://crl.chambersign.org/chambersignroot.crl0",
"http://crl.chambersign.org/chambersroot.crl0",
"http://crl.comodoca.com/AAACertificateServices.crl06",
"http://crl.defence.gov.au/pki0",
"http://crl.dhimyotis.com/certignarootca.crl0",
"http://crl.globalsign.net/root-r2.crl0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://crl.oces.trust2408.com/oces.crl0",
"http://crl.pki.wellsfargo.com/wsprca.crl0",
"http://crl.securetrust.com/SGCA.crl0",
"http://crl.securetrust.com/STCA.crl0",
"http://crl.ssc.lt/root-a/cacrl.crl0",
"http://crl.ssc.lt/root-b/cacrl.crl0",
"http://crl.ssc.lt/root-c/cacrl.crl0",
"http://crl.xrampsecurity.com/XGCA.crl0",
"http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
"http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635",
"http://cygwin.cathedral-g3",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org)",
"http://cygwin.cathedral-networks.org.haz&",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/)",
"http://cygwin.cathedral-networks.org/-6",
"http://cygwin.cathedral-networks.org/.S",
"http://cygwin.cathedral-networks.org/.dc",
"http://cygwin.cathedral-networks.org/.i",
"http://cygwin.cathedral-networks.org/.o",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org///E/",
"http://cygwin.cathedral-networks.org//J-X",
"http://cygwin.cathedral-networks.org//S&7",
"http://cygwin.cathedral-networks.org//V",
"http://cygwin.cathedral-networks.org//f",
"http://cygwin.cathedral-networks.org//fA",
"http://cygwin.cathedral-networks.org//lV(",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org//mirror0",
"http://cygwin.cathedral-networks.org//p-V",
"http://cygwin.cathedral-networks.org//w",
"http://cygwin.cathedral-networks.org//wm&",
"http://cygwin.cathedral-networks.org/9",
"http://cygwin.cathedral-networks.org/;$",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/?",
"http://cygwin.cathedral-networks.org/?;",
"http://cygwin.cathedral-networks.org/Am.",
"http://cygwin.cathedral-networks.org/H",
"http://cygwin.cathedral-networks.org/H)",
"http://cygwin.cathedral-networks.org/H3",
"http://cygwin.cathedral-networks.org/L",
"http://cygwin.cathedral-networks.org/L&",
"http://cygwin.cathedral-networks.org/U",
"http://cygwin.cathedral-networks.org/W",
"http://cygwin.cathedral-networks.org/Y3",
"http://cygwin.cathedral-networks.org/a3",
"http://cygwin.cathedral-networks.org/buu",
"http://cygwin.cathedral-networks.org/cB",
"http://cygwin.cathedral-networks.org/cy",
"http://cygwin.cathedral-networks.org/d",
"http://cygwin.cathedral-networks.org/d3",
"http://cygwin.cathedral-networks.org/e",
"http://cygwin.cathedral-networks.org/ha",
"http://cygwin.cathedral-networks.org/i",
"http://cygwin.cathedral-networks.org/ia",
"http://cygwin.cathedral-networks.org/in",
"http://cygwin.cathedral-networks.org/j",
"http://cygwin.cathedral-networks.org/k",
"http://cygwin.cathedral-networks.org/l",
"http://cygwin.cathedral-networks.org/ly",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/mi",
"http://cygwin.cathedral-networks.org/nc(",
"http://cygwin.cathedral-networks.org/ni",
"http://cygwin.cathedral-networks.org/o)Y",
"http://cygwin.cathedral-networks.org/on",
"http://cygwin.cathedral-networks.org/p/",
"http://cygwin.cathedral-networks.org/p1",
"http://cygwin.cathedral-networks.org/pl9",
"http://cygwin.cathedral-networks.org/q",
"http://cygwin.cathedral-networks.org/q.",
"http://cygwin.cathedral-networks.org/r-v&",
"http://cygwin.cathedral-networks.org/r0",
"http://cygwin.cathedral-networks.org/ro-",
"http://cygwin.cathedral-networks.org/rz",
"http://cygwin.cathedral-networks.org/s/",
"http://cygwin.cathedral-networks.org/s/t",
"http://cygwin.cathedral-networks.org/st&",
"http://cygwin.cathedral-networks.org/t$",
"http://cygwin.cathedral-networks.org/tc",
"http://cygwin.cathedral-networks.org/te_",
"http://cygwin.cathedral-networks.org/tp",
"http://cygwin.cathedral-networks.org/u",
"http://cygwin.cathedral-networks.org/unS",
"http://cygwin.cathedral-networks.org/wn",
"http://cygwin.cathedral-networks.org/y1",
"http://cygwin.cathedral-networks.org/ygB",
"http://cygwin.cathedral-networks.org/~6",
"http://cygwin.cathedral-networks.org6",
"http://cygwin.cathedral-networks.org://",
"http://cygwin.cathedral-networks.orgA&",
"http://cygwin.cathedral-networks.orgS",
"http://cygwin.cathedral-networks.orgT",
"http://cygwin.cathedral-networks.orgb/c",
"http://cygwin.cathedral-networks.orgb6",
"http://cygwin.cathedral-networks.orgd",
"http://cygwin.cathedral-networks.orgi",
"http://cygwin.cathedral-networks.orgl",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgn/V",
"http://cygwin.cathedral-networks.orgn/X",
"http://cygwin.cathedral-networks.orgn/w3",
"http://cygwin.cathedral-networks.orgomH",
"http://cygwin.cathedral-networks.orgon",
"http://cygwin.cathedral-networks.orgown",
"http://cygwin.cathedral-networks.orgp6",
"http://cygwin.cathedral-networks.orgtsc",
"http://cygwin.cathedral-networks.orgwin",
"http://cygwin.cathedral-networks.orgwnl",
"http://cygwin.cathedral-networks.orgx",
"http://cygwin.cathedral-networks.orgygw",
"http://cygwin.cathedral-s-W",
"http://cygwin.mbwarez",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk.",
"http://cygwin.mbwarez.dk.ac.jp/N%",
"http://cygwin.mbwarez.dk.ac.jpin/aren.net",
"http://cygwin.mbwarez.dk.aur/cygwin/",
"http://cygwin.mbwarez.dk.byn//7",
"http://cygwin.mbwarez.dk.de/cygwin/",
"http://cygwin.mbwarez.dk.deorks.orga",
"http://cygwin.mbwarez.dk.net",
"http://cygwin.mbwarez.dk.netwin/s://e",
"http://cygwin.mbwarez.dk.orgcygwin/yg",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/#",
"http://cygwin.mbwarez.dk/#p.fau.de",
"http://cygwin.mbwarez.dk/$",
"http://cygwin.mbwarez.dk/$$",
"http://cygwin.mbwarez.dk/%",
"http://cygwin.mbwarez.dk/.ac.nz",
"http://cygwin.mbwarez.dk/.at/cygwin//;.",
"http://cygwin.mbwarez.dk/.cn/cygwin/",
"http://cygwin.mbwarez.dk/.cn/cygwin///e",
"http://cygwin.mbwarez.dk/.cnygwin/",
"http://cygwin.mbwarez.dk/.iij.ad.jpjpQ",
"http://cygwin.mbwarez.dk/.nc",
"http://cygwin.mbwarez.dk/.nete",
"http://cygwin.mbwarez.dk/.netgwin/",
"http://cygwin.mbwarez.dk///cygwin/",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin/.gar",
"http://cygwin.mbwarez.dk//cygwin//",
"http://cygwin.mbwarez.dk//cygwin//sd",
"http://cygwin.mbwarez.dk//cygwin/n/",
"http://cygwin.mbwarez.dk//gwin//g",
"http://cygwin.mbwarez.dk//n/",
"http://cygwin.mbwarez.dk/1",
"http://cygwin.mbwarez.dk/5A",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/Asia/",
"http://cygwin.mbwarez.dk/E",
"http://cygwin.mbwarez.dk/Europe",
"http://cygwin.mbwarez.dk/F",
"http://cygwin.mbwarez.dk/Hong",
"http://cygwin.mbwarez.dk/achen.deo",
"http://cygwin.mbwarez.dk/agata-u.ac.jp",
"http://cygwin.mbwarez.dk/bygwin/",
"http://cygwin.mbwarez.dk/c.jp",
"http://cygwin.mbwarez.dk/chum.degwin/",
"http://cygwin.mbwarez.dk/cn/cygwin/",
"http://cygwin.mbwarez.dk/cn/cygwin/.e",
"http://cygwin.mbwarez.dk/cnso.net/",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin//",
"http://cygwin.mbwarez.dk/cygwin/I",
"http://cygwin.mbwarez.dk/cygwin/K",
"http://cygwin.mbwarez.dk/cygwin/R2",
"http://cygwin.mbwarez.dk/cygwin/W",
"http://cygwin.mbwarez.dk/cygwin/et",
"http://cygwin.mbwarez.dk/cygwin/gwin/N",
"http://cygwin.mbwarez.dk/cygwin/in/",
"http://cygwin.mbwarez.dk/cygwin/in//",
"http://cygwin.mbwarez.dk/cygwin/n",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/n/N",
"http://cygwin.mbwarez.dk/cygwin/win/",
"http://cygwin.mbwarez.dk/d.com/cygwin/",
"http://cygwin.mbwarez.dk/d.com/gwin/",
"http://cygwin.mbwarez.dk/d.comn/",
"http://cygwin.mbwarez.dk/de",
"http://cygwin.mbwarez.dk/de/cygwin//",
"http://cygwin.mbwarez.dk/de/cygwin/EuropeH0",
"http://cygwin.mbwarez.dk/derror.easyna",
"http://cygwin.mbwarez.dk/e/cygwin/",
"http://cygwin.mbwarez.dk/e:",
"http://cygwin.mbwarez.dk/ea.ptttps://",
"http://cygwin.mbwarez.dk/ebsd.orgc.jp",
"http://cygwin.mbwarez.dk/egwin/win/",
"http://cygwin.mbwarez.dk/et/cygwin/",
"http://cygwin.mbwarez.dk/etn//",
"http://cygwin.mbwarez.dk/fly.by.nc",
"http://cygwin.mbwarez.dk/g/cygwin/F-c",
"http://cygwin.mbwarez.dk/g/cygwin/i",
"http://cygwin.mbwarez.dk/g/cygwin/mq",
"http://cygwin.mbwarez.dk/g/cygwin/w",
"http://cygwin.mbwarez.dk/g/cygwin/~",
"http://cygwin.mbwarez.dk/gie.frpt/soft_",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin//",
"http://cygwin.mbwarez.dk/gwin//win/",
"http://cygwin.mbwarez.dk/gwin/W",
"http://cygwin.mbwarez.dk/gwin/cn/cyd",
"http://cygwin.mbwarez.dk/gwin/n/C/B",
"http://cygwin.mbwarez.dk/gwin/n/liZ-o",
"http://cygwin.mbwarez.dk/gwin/n32/",
"http://cygwin.mbwarez.dk/gwin/ope",
"http://cygwin.mbwarez.dk/gwin/p://cy/",
"http://cygwin.mbwarez.dk/gwin/win/b",
"http://cygwin.mbwarez.dk/h.de",
"http://cygwin.mbwarez.dk/hen.de",
"http://cygwin.mbwarez.dk/hen.deorg/",
"http://cygwin.mbwarez.dk/in.uib.no/",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in//",
"http://cygwin.mbwarez.dk/in//$",
"http://cygwin.mbwarez.dk/in/cygwin/e8",
"http://cygwin.mbwarez.dk/in/cygwin/ft",
"http://cygwin.mbwarez.dk/in/gwin/l",
"http://cygwin.mbwarez.dk/in/in//7",
"http://cygwin.mbwarez.dk/in/in/ac",
"http://cygwin.mbwarez.dk/in/in/n/",
"http://cygwin.mbwarez.dk/in/in/r.",
"http://cygwin.mbwarez.dk/in/n/",
"http://cygwin.mbwarez.dk/in/ong",
"http://cygwin.mbwarez.dk/in/siaN2",
"http://cygwin.mbwarez.dk/in/tp://su",
"http://cygwin.mbwarez.dk/in/win/",
"http://cygwin.mbwarez.dk/in/ygwin",
"http://cygwin.mbwarez.dk/inade",
"http://cygwin.mbwarez.dk/irror.easynr-",
"http://cygwin.mbwarez.dk/jp",
"http://cygwin.mbwarez.dk/ly.coml",
"http://cygwin.mbwarez.dk/ly.comn/r",
"http://cygwin.mbwarez.dk/m.de/cygwin/",
"http://cygwin.mbwarez.dk/m/cygwin/",
"http://cygwin.mbwarez.dk/mgwin/rrors./",
"http://cygwin.mbwarez.dk/n.itefix.nef",
"http://cygwin.mbwarez.dk/n/",
"http://cygwin.mbwarez.dk/n/al.ca/",
"http://cygwin.mbwarez.dk/n/cygw",
"http://cygwin.mbwarez.dk/n/gwin/du",
"http://cygwin.mbwarez.dk/n/win//",
"http://cygwin.mbwarez.dk/n/ygwin/",
"http://cygwin.mbwarez.dk/net//63.com",
"http://cygwin.mbwarez.dk/net/il",
"http://cygwin.mbwarez.dk/ngwin/cente",
"http://cygwin.mbwarez.dk/no/cygwin/",
"http://cygwin.mbwarez.dk/nter.byuni$",
"http://cygwin.mbwarez.dk/o/cygwin/",
"http://cygwin.mbwarez.dk/o/cygwin/A",
"http://cygwin.mbwarez.dk/o/cygwin/t",
"http://cygwin.mbwarez.dk/ochum.depe",
"http://cygwin.mbwarez.dk/ochum.deps://p",
"http://cygwin.mbwarez.dk/om/cygwin/$/",
"http://cygwin.mbwarez.dk/om/cygwin//",
"http://cygwin.mbwarez.dk/orgcom",
"http://cygwin.mbwarez.dk/p.fau.dein",
"http://cygwin.mbwarez.dk/pub/softwarV",
"http://cygwin.mbwarez.dk/r.datacente1",
"http://cygwin.mbwarez.dk/rg/cygwin/",
"http://cygwin.mbwarez.dk/rgasso.net",
"http://cygwin.mbwarez.dk/rggwin/t//",
"http://cygwin.mbwarez.dk/rlands",
"http://cygwin.mbwarez.dk/st.comin/",
"http://cygwin.mbwarez.dk/t/cygwin/",
"http://cygwin.mbwarez.dk/t/cygwin/O",
"http://cygwin.mbwarez.dk/t/cygwin/an",
"http://cygwin.mbwarez.dk/t/cygwin/ygw",
"http://cygwin.mbwarez.dk/te.nlchen.%",
"http://cygwin.mbwarez.dk/tworks.org",
"http://cygwin.mbwarez.dk/u.cn/cygwin/.",
"http://cygwin.mbwarez.dk/ub/cygwin/%",
"http://cygwin.mbwarez.dk/unsite.icm.:",
"http://cygwin.mbwarez.dk/win.uib.no///",
"http://cygwin.mbwarez.dk/win/",
"http://cygwin.mbwarez.dk/win/B",
"http://cygwin.mbwarez.dk/win/ac.jp",
"http://cygwin.mbwarez.dk/win/gwin/",
"http://cygwin.mbwarez.dk/win/in/",
"http://cygwin.mbwarez.dk/win/in//",
"http://cygwin.mbwarez.dk/win/in/sl",
"http://cygwin.mbwarez.dk/win/inam.l",
"http://cygwin.mbwarez.dk/win/n/",
"http://cygwin.mbwarez.dk/win/n//",
"http://cygwin.mbwarez.dk/win/n/in/",
"http://cygwin.mbwarez.dk/win/om",
"http://cygwin.mbwarez.dk/win/tps://",
"http://cygwin.mbwarez.dk/ygwin/",
"http://cygwin.mbwarez.dk/ygwin/.net",
"http://cygwin.mbwarez.dk/ygwin//",
"http://cygwin.mbwarez.dk/ygwin///",
"http://cygwin.mbwarez.dk/ygwin///_",
"http://cygwin.mbwarez.dk/ygwin//rcf",
"http://cygwin.mbwarez.dk/ygwin/P",
"http://cygwin.mbwarez.dk/ygwin/a/O",
"http://cygwin.mbwarez.dk/ygwin/gwin/f",
"http://cygwin.mbwarez.dk/ygwin/in/://%",
"http://cygwin.mbwarez.dk/ygwin/no//",
"http://cygwin.mbwarez.dk/ygwin/tp://ft"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "238"
},
{
"description": "Uses secure TLS version for HTTPS connections",
"match_data": [
"8.43.85.97:443 -> 192.168.2.12:49728 version: TLS 1.2"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "7058"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"refs": [
{
"ref": "#memory_dumps",
"value": "software.exe, 00000000.00000002.4957179451.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, software.exe, 00000000.00000002.4956225446.000000000016C000.00000004.00000020.00020000.00000000.sdmp"
}
],
"match_data": [
"Hyper-V RAW"
],
"id": "263",
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"ftp://ftp.=",
"ftp://ftp.byfly.by/pub/cygwin/http://f",
"ftp://ftp.byfly.by/pub/cygwin/ub/cygwin/cacygwin",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://cG",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/win",
"ftp://ftp.fsn.hu/pub/cygwin/p",
"ftp://ftp.fsn.hu/pub/cygwin/ror",
"ftp://ftp.fsn.hu/pub/cygwin/ygwin/https://)",
"ftp://ftp.fsn.hur",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://d",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://f",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.inf.tu-dresden.deftp",
"ftp://ftp.inf.tu-dresden.dehttp://ftp.f",
"ftp://ftp.inf.tu-dresden.dein",
"ftp://ftp.inf.tu-dresden.deygwin",
"ftp://ftp.kr.freebsd.org",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://c",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://f",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://0",
"ftp://ftp.l",
"ftp://ftp.lip6.fr/pub/cygwin//https://",
"ftp://ftp.m2",
"ftp://ftp.muug.ca/mirror/cygwin//or",
"ftp://ftp.n",
"ftp://ftp.ntua.gr/pub/pc/cygwin/",
"ftp://ftp.ntua.gr/pub/pc/cygwin/http:/",
"ftp://ftp.rnl.tecnico.ulisboa.pt",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/http://c",
"ftp://linux.rz.ruhr-uni-bochum.de/cygwin/http://c",
"ftp://mirror.checkdomain.de/cygwin/",
"ftp://mirror.checkdomain.de/cygwin/http",
"ftp://mirror.checkdomain.de/cygwin/httpA",
"ftp://mirror.checkdomain.de/cygwin/https://",
"ftp://mirror.checkdomain.dehttp://w",
"ftp://mirror.checkdomain.dein",
"ftp://mirror.csclub.uwaterloo.car",
"ftp://mirror.datacenter.bymirror",
"ftp://mirror.datacenter.byon.ncr",
"ftp://mirror.easyname.at/cygwin/r",
"ftp://mirror.easyname.atomygwin",
"ftp://mirror.lagoon.nc/cygwin/http://f",
"ftp://mirror.lagoon.nc/cygwin/http://m",
"ftp://mirror.lagoon.nc/cygwin/ror",
"ftp://mirrors.dotsrc.org.nethttps://V",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/http://muug.ca/",
"ftp://mirrors.netix.net/cygwin/http://fL",
"ftp://mirrors.netix.net/cygwin/https://",
"ftp://mirrors.netix.net/cygwin/https://z",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/https://",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/https://_",
"ftp://sunsite.icm.edu.plftp",
"http://ac.economia.gob.mx/cps.html0",
"http://ac.economia.gob.mx/last.crl0G",
"http://acedicom.edicomgroup.com/doc0",
"http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?",
"http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0",
"http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://ca.disig.sk/ca/crl/ca_disig.crl0",
"http://ca.mtin.es/mtin/DPCyPoliticas0",
"http://ca.mtin.es/mtin/DPCyPoliticas0g",
"http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03",
"http://ca.mtin.es/mtin/ocsp0",
"http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0",
"http://certificates.starfieldtech.com/repository/1604",
"http://certs.oati.net/repository/OATICA2.crl0",
"http://certs.oati.net/repository/OATICA2.crt0",
"http://certs.oaticerts.com/repository/OATICA2.crl",
"http://certs.oaticerts.com/repository/OATICA2.crt08",
"http://cps.chambersign.org/cps/chambersignroot.html0",
"http://cps.chambersign.org/cps/chambersroot.html0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://cps.siths.se/sithsrootcav1.html0",
"http://crl.certigna.fr/certignarootca.crl01",
"http://crl.chambersign.org/chambersignroot.crl0",
"http://crl.chambersign.org/chambersroot.crl0",
"http://crl.comodoca.com/AAACertificateServices.crl06",
"http://crl.defence.gov.au/pki0",
"http://crl.dhimyotis.com/certignarootca.crl0",
"http://crl.globalsign.net/root-r2.crl0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://crl.oces.trust2408.com/oces.crl0",
"http://crl.pki.wellsfargo.com/wsprca.crl0",
"http://crl.securetrust.com/SGCA.crl0",
"http://crl.securetrust.com/STCA.crl0",
"http://crl.ssc.lt/root-a/cacrl.crl0",
"http://crl.ssc.lt/root-b/cacrl.crl0",
"http://crl.ssc.lt/root-c/cacrl.crl0",
"http://crl.xrampsecurity.com/XGCA.crl0",
"http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enR(",
"http://ctldl.windowsupdate.com:80",
"http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635",
"http://cygwin.cathedral-",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org.ne",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/#",
"http://cygwin.cathedral-networks.org/$",
"http://cygwin.cathedral-networks.org/%",
"http://cygwin.cathedral-networks.org/&",
"http://cygwin.cathedral-networks.org/)",
"http://cygwin.cathedral-networks.org/.",
"http://cygwin.cathedral-networks.org/.cN",
"http://cygwin.cathedral-networks.org/.m",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org//:",
"http://cygwin.cathedral-networks.org//c",
"http://cygwin.cathedral-networks.org//e",
"http://cygwin.cathedral-networks.org//f",
"http://cygwin.cathedral-networks.org//j",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org//o",
"http://cygwin.cathedral-networks.org/1",
"http://cygwin.cathedral-networks.org/4",
"http://cygwin.cathedral-networks.org/6",
"http://cygwin.cathedral-networks.org/8",
"http://cygwin.cathedral-networks.org/9",
"http://cygwin.cathedral-networks.org/:",
"http://cygwin.cathedral-networks.org/:/",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/=",
"http://cygwin.cathedral-networks.org/A",
"http://cygwin.cathedral-networks.org/F",
"http://cygwin.cathedral-networks.org/G",
"http://cygwin.cathedral-networks.org/L",
"http://cygwin.cathedral-networks.org/O",
"http://cygwin.cathedral-networks.org/T",
"http://cygwin.cathedral-networks.org/U",
"http://cygwin.cathedral-networks.org/Y",
"http://cygwin.cathedral-networks.org/Z",
"http://cygwin.cathedral-networks.org/a",
"http://cygwin.cathedral-networks.org/ar",
"http://cygwin.cathedral-networks.org/cygwin/s.org/",
"http://cygwin.cathedral-networks.org/e",
"http://cygwin.cathedral-networks.org/et",
"http://cygwin.cathedral-networks.org/f",
"http://cygwin.cathedral-networks.org/ft",
"http://cygwin.cathedral-networks.org/ft9",
"http://cygwin.cathedral-networks.org/ine",
"http://cygwin.cathedral-networks.org/k",
"http://cygwin.cathedral-networks.org/l",
"http://cygwin.cathedral-networks.org/li~",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/mi",
"http://cygwin.cathedral-networks.org/n/u",
"http://cygwin.cathedral-networks.org/ne8",
"http://cygwin.cathedral-networks.org/ni",
"http://cygwin.cathedral-networks.org/o",
"http://cygwin.cathedral-networks.org/ore",
"http://cygwin.cathedral-networks.org/ork",
"http://cygwin.cathedral-networks.org/ps",
"http://cygwin.cathedral-networks.org/q",
"http://cygwin.cathedral-networks.org/slo",
"http://cygwin.cathedral-networks.org/su",
"http://cygwin.cathedral-networks.org/t",
"http://cygwin.cathedral-networks.org/tp",
"http://cygwin.cathedral-networks.org/ul",
"http://cygwin.cathedral-networks.org/w",
"http://cygwin.cathedral-networks.org/wi",
"http://cygwin.cathedral-networks.org/x",
"http://cygwin.cathedral-networks.org/z",
"http://cygwin.cathedral-networks.org0",
"http://cygwin.cathedral-networks.org1",
"http://cygwin.cathedral-networks.org://",
"http://cygwin.cathedral-networks.orgB",
"http://cygwin.cathedral-networks.orgI",
"http://cygwin.cathedral-networks.orgM",
"http://cygwin.cathedral-networks.orgP",
"http://cygwin.cathedral-networks.orgR",
"http://cygwin.cathedral-networks.orgT",
"http://cygwin.cathedral-networks.org_",
"http://cygwin.cathedral-networks.orgala",
"http://cygwin.cathedral-networks.orgb",
"http://cygwin.cathedral-networks.orgdu.",
"http://cygwin.cathedral-networks.orgjpo",
"http://cygwin.cathedral-networks.orgm",
"http://cygwin.cathedral-networks.orgme",
"http://cygwin.cathedral-networks.orgn",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgn/#",
"http://cygwin.cathedral-networks.orgnet",
"http://cygwin.cathedral-networks.orgom.",
"http://cygwin.cathedral-networks.orgr.tD",
"http://cygwin.cathedral-networks.orgs",
"http://cygwin.cathedral-networks.orgtp:",
"http://cygwin.cathedral-networks.orgwen?",
"http://cygwin.cathedral-networks.orgz",
"http://cygwin.mbwarez",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk#W",
"http://cygwin.mbwarez.dk$",
"http://cygwin.mbwarez.dk.ac.jpn/in/",
"http://cygwin.mbwarez.dk.byygwin/",
"http://cygwin.mbwarez.dk.de/n/",
"http://cygwin.mbwarez.dk.kr.freebsd.orgi",
"http://cygwin.mbwarez.dk.net.it",
"http://cygwin.mbwarez.dk.netA",
"http://cygwin.mbwarez.dk.netgw",
"http://cygwin.mbwarez.dk.orgygwin/",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/#Y",
"http://cygwin.mbwarez.dk/.de/",
"http://cygwin.mbwarez.dk/.deon.net",
"http://cygwin.mbwarez.dk/.edu.cn/",
"http://cygwin.mbwarez.dk/.hu/pub/cygwin",
"http://cygwin.mbwarez.dk/.jpygwin/",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk///",
"http://cygwin.mbwarez.dk///mirror.easyn",
"http://cygwin.mbwarez.dk//?",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin/or",
"http://cygwin.mbwarez.dk//cygwin32/",
"http://cygwin.mbwarez.dk//n/",
"http://cygwin.mbwarez.dk//n/ropeZ",
"http://cygwin.mbwarez.dk//pub/cygwin/",
"http://cygwin.mbwarez.dk//pub/cygwin/P",
"http://cygwin.mbwarez.dk/3.com",
"http://cygwin.mbwarez.dk/4",
"http://cygwin.mbwarez.dk/7",
"http://cygwin.mbwarez.dk/:",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/D",
"http://cygwin.mbwarez.dk/E",
"http://cygwin.mbwarez.dk/Europe",
"http://cygwin.mbwarez.dk/F",
"http://cygwin.mbwarez.dk/G",
"http://cygwin.mbwarez.dk/Hong",
"http://cygwin.mbwarez.dk/P",
"http://cygwin.mbwarez.dk/Q",
"http://cygwin.mbwarez.dk/achen.derg/",
"http://cygwin.mbwarez.dk/argasso.net/",
"http://cygwin.mbwarez.dk/b",
"http://cygwin.mbwarez.dk/boa.pt",
"http://cygwin.mbwarez.dk/c",
"http://cygwin.mbwarez.dk/c.jpn//",
"http://cygwin.mbwarez.dk/cn/cygwin/",
"http://cygwin.mbwarez.dk/cn/cygwin/A",
"http://cygwin.mbwarez.dk/cn/cygwin/u",
"http://cygwin.mbwarez.dk/cyg",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin//s",
"http://cygwin.mbwarez.dk/cygwin/:",
"http://cygwin.mbwarez.dk/cygwin/gwin/",
"http://cygwin.mbwarez.dk/cygwin/ia://",
"http://cygwin.mbwarez.dk/cygwin/mir",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/n/A",
"http://cygwin.mbwarez.dk/d.com",
"http://cygwin.mbwarez.dk/d.comwin/",
"http://cygwin.mbwarez.dk/ddos.net/cygwia",
"http://cygwin.mbwarez.dk/ent.co",
"http://cygwin.mbwarez.dk/er.by/pub/m7",
"http://cygwin.mbwarez.dk/et",
"http://cygwin.mbwarez.dk/et.fi0",
"http://cygwin.mbwarez.dk/et/cygwin/D",
"http://cygwin.mbwarez.dk/et/cygwin/u",
"http://cygwin.mbwarez.dk/etcygwin/B",
"http://cygwin.mbwarez.dk/etoml",
"http://cygwin.mbwarez.dk/etworks.org",
"http://cygwin.mbwarez.dk/etworks.org/",
"http://cygwin.mbwarez.dk/etworks.org/n",
"http://cygwin.mbwarez.dk/g/cygwin/",
"http://cygwin.mbwarez.dk/g/cygwin/P",
"http://cygwin.mbwarez.dk/g/cygwin/cns/cygwin/",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin/.net/",
"http://cygwin.mbwarez.dk/gwin//",
"http://cygwin.mbwarez.dk/gwin/2/",
"http://cygwin.mbwarez.dk/gwin/Y",
"http://cygwin.mbwarez.dk/gwin/h",
"http://cygwin.mbwarez.dk/gwin/in/",
"http://cygwin.mbwarez.dk/gwin/ror.c",
"http://cygwin.mbwarez.dk/gwin/s://",
"http://cygwin.mbwarez.dk/gwin/ygwin/m",
"http://cygwin.mbwarez.dk/i",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in/.cnn/",
"http://cygwin.mbwarez.dk/in//n/B",
"http://cygwin.mbwarez.dk/in//win/D",
"http://cygwin.mbwarez.dk/in/2",
"http://cygwin.mbwarez.dk/in/in/",
"http://cygwin.mbwarez.dk/in/in/Y",
"http://cygwin.mbwarez.dk/in/n",
"http://cygwin.mbwarez.dk/in/n/",
"http://cygwin.mbwarez.dk/in/n/://",
"http://cygwin.mbwarez.dk/in/win//",
"http://cygwin.mbwarez.dk/in/ygwin/",
"http://cygwin.mbwarez.dk/inan/n//t",
"http://cygwin.mbwarez.dk/inf.tu-dresden",
"http://cygwin.mbwarez.dk/inrausch",
"http://cygwin.mbwarez.dk/loo.ca",
"http://cygwin.mbwarez.dk/m/cygwin/",
"http://cygwin.mbwarez.dk/m/cygwin//U",
"http://cygwin.mbwarez.dk/m/cygwin/byfl",
"http://cygwin.mbwarez.dk/m/cygwin/in/-",
"http://cygwin.mbwarez.dk/mirror",
"http://cygwin.mbwarez.dk/n/.netrg",
"http://cygwin.mbwarez.dk/n///",
"http://cygwin.mbwarez.dk/n//gwin/",
"http://cygwin.mbwarez.dk/n/Asiame.1",
"http://cygwin.mbwarez.dk/n/cygwin/=",
"http://cygwin.mbwarez.dk/n/gwin/",
"http://cygwin.mbwarez.dk/n/in/c",
"http://cygwin.mbwarez.dk/n/win/",
"http://cygwin.mbwarez.dk/net/n/",
"http://cygwin.mbwarez.dk/nin/",
"http://cygwin.mbwarez.dk/o/cygwin/",
"http://cygwin.mbwarez.dk/om.com/B",
"http://cygwin.mbwarez.dk/om/cygwin/",
"http://cygwin.mbwarez.dk/omom/cygwin/",
"http://cygwin.mbwarez.dk/org/in/b",
"http://cygwin.mbwarez.dk/orggwin/",
"http://cygwin.mbwarez.dk/orgrs",
"http://cygwin.mbwarez.dk/ost.noz.dkV",
"http://cygwin.mbwarez.dk/p",
"http://cygwin.mbwarez.dk/ps://mirror-hk",
"http://cygwin.mbwarez.dk/pub/cygwin//",
"http://cygwin.mbwarez.dk/r.cP",
"http://cygwin.mbwarez.dk/rafal.ca/",
"http://cygwin.mbwarez.dk/rg/cygwin/",
"http://cygwin.mbwarez.dk/rg/sites/sourcC",
"http://cygwin.mbwarez.dk/rgP",
"http://cygwin.mbwarez.dk/rgasso.net",
"http://cygwin.mbwarez.dk/rgasso.net/",
"http://cygwin.mbwarez.dk/rks.netn//",
"http://cygwin.mbwarez.dk/ropeusch.de/m",
"http://cygwin.mbwarez.dk/s/cygwin/",
"http://cygwin.mbwarez.dk/s:/p",
"http://cygwin.mbwarez.dk/st.comt",
"http://cygwin.mbwarez.dk/t",
"http://cygwin.mbwarez.dk/t/cygwin//",
"http://cygwin.mbwarez.dk/t/cygwin/p",
"http://cygwin.mbwarez.dk/tc.edu.cnY",
"http://cygwin.mbwarez.dk/tin//in/",
"http://cygwin.mbwarez.dk/twaren.net",
"http://cygwin.mbwarez.dk/tworks.org/k",
"http://cygwin.mbwarez.dk/u.cn/cygwin/$",
"http://cygwin.mbwarez.dk/u.cnn/",
"http://cygwin.mbwarez.dk/u.cns.orgn/V",
"http://cygwin.mbwarez.dk/ua.gr/pub/pc/cn",
"http://cygwin.mbwarez.dk/win/",
"http://cygwin.mbwarez.dk/win/.redhas",
"http://cygwin.mbwarez.dk/win//n/2",
"http://cygwin.mbwarez.dk/win/gwin/",
"http://cygwin.mbwarez.dk/win/in/Y",
"http://cygwin.mbwarez.dk/win/inaUn",
"http://cygwin.mbwarez.dk/win/n/",
"http://cygwin.mbwarez.dk/win/n/n/",
"http://cygwin.mbwarez.dk/win/rg/",
"http://cygwin.mbwarez.dk/ygwin/",
"http://cygwin.mbwarez.dk/ygwin//",
"http://cygwin.mbwarez.dk/ygwin//b",
"http://cygwin.mbwarez.dk/ygwin//~",
"http://cygwin.mbwarez.dk/ygwin/4",
"http://cygwin.mbwarez.dk/ygwin/I",
"http://cygwin.mbwarez.dk/ygwin/n/",
"http://cygwin.mbwarez.dk/ygwin/r-hk",
"http://cygwin.mbwarez.dk://mirrors.ustc",
"http://cygwin.mbwarez.dkAsia",
"http://cygwin.mbwarez.dkI",
"http://cygwin.mbwarez.dkM",
"http://cygwin.mbwarez.dkare.org/pub/cyg",
"http://cygwin.mbwarez.dkb/cygwin//",
"http://cygwin.mbwarez.dkb/cygwin/n/2/",
"http://cygwin.mbwarez.dkc",
"http://cygwin.mbwarez.dkchen.dee",
"http://cygwin.mbwarez.dkcn/cygwin/",
"http://cygwin.mbwarez.dkcygwin/",
"http://cygwin.mbwarez.dke",
"http://cygwin.mbwarez.dken.den/",
"http://cygwin.mbwarez.dkeq.uc.pt/softwa",
"http://cygwin.mbwarez.dkett.ca",
"http://cygwin.mbwarez.dketworks.orgx",
"http://cygwin.mbwarez.dkg",
"http://cygwin.mbwarez.dkg/cygwin/",
"http://cygwin.mbwarez.dkgwin.uib.no/",
"http://cygwin.mbwarez.dkgwin/",
"http://cygwin.mbwarez.dkgwin/gwin/",
"http://cygwin.mbwarez.dkgwin/n//",
"http://cygwin.mbwarez.dkgwin/omn//",
"http://cygwin.mbwarez.dkh.deks.org/1",
"http://cygwin.mbwarez.dkhina",
"http://cygwin.mbwarez.dkin/ygwin/",
"http://cygwin.mbwarez.dkinraus",
"http://cygwin.mbwarez.dkirrors.163.com",
"http://cygwin.mbwarez.dkl.jpygwin/",
"http://cygwin.mbwarez.dklt.comorg/V",
"http://cygwin.mbwarez.dkm/cygwin/",
"http://cygwin.mbwarez.dkmcom/cygwin/",
"http://cygwin.mbwarez.dkmirror",
"http://cygwin.mbwarez.dkn.net"
],
"id": "238",
"description": "URLs found in memory or binary data"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\ETCJ2WHM\\mirrors[1].lst"
],
"id": "90",
"description": "Creates files inside the user directory"
},
{
"id": "198",
"match_data": [
"HKEY_CURRENT_USER_Classes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot"
],
"description": "Monitors certain registry keys / values for changes (often done to protect autostart functionality)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "625",
"match_data": [
"HTTP traffic on port 443 -> 49717",
"HTTP traffic on port 49717 -> 443"
],
"description": "Uses HTTPS",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "263",
"refs": [
{
"ref": "#memory_dumps",
"value": "file.exe, 00000000.00000002.4637826316.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4638844961.0000000000D36000.00000004.00000020.00020000.00000000.sdmp"
}
],
"match_data": [
"Hyper-V RAW"
],
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "238",
"match_data": [
"ftp://cygwin.mirror.rafal.ca",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://f?",
"ftp://ftp.fa",
"ftp://ftp.fsn.hu/pub/cygwin/win/",
"ftp://ftp.fsn.hu/pub/cygwin/ygwin/https://",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/gwin/https://",
"ftp://ftp.halifax.rwth-aachen.de",
"ftp://ftp.halifax.rwth-aachen.de/cygwin/",
"ftp://ftp.halifax.rwth-aachen.der",
"ftp://ftp.halifax.rwth-aachen.des",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://f",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://m",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://#",
"ftp://ftp.iij.ad.jp/pub/cygwin/ors",
"ftp://ftp.inf.tu-dresden.dehttps://",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://f",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://l",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://",
"ftp://ftp.kr.freebsd.orgx",
"ftp://ftp.kr.freebsd.orgygwin",
"ftp://ftp.mirrorservice.org/sites/sourceware.org/pub/cygwin/",
"ftp://ftp.n",
"ftp://ftp.n1",
"ftp://ftp.ntua.gr",
"ftp://ftp.ntua.gr/pub/pc/cygwin/r",
"ftp://ftp.snt.utwente.nl",
"ftp://ftp.snt.utwente.nlix",
"ftp://ftp.snt.utwente.nlom",
"ftp://ftp.snt.utwente.nlwin/win",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/ygwin//http",
"ftp://ftp.yz.yamagata-u.ac.jphttp://m",
"ftp://ftp.yz.yamagata-u.ac.jpin/http:/",
"ftp://ftp.yz.yamagata-u.ac.jpp",
"ftp://ftp.yz.yamagata-u.ac.jpphttps://c",
"ftp://ftp.yz.yamagata-u.ac.jprror",
"ftp://linux.rz.ruhr-uni-bochum.de/cygwin/gwin//n/",
"ftp://mirror.checkdomain.dehttp://ftp.f",
"ftp://mirror.checkdomain.dehttps://",
"ftp://mirror.csclub.uwaterloo.ca",
"ftp://mirror.datacenter.by/pub/mirrors/cygwin/in/",
"ftp://mirror.datacenter.bywin/http://f",
"ftp://mirror.easyname.atel",
"ftp://mirror.easyname.atftp",
"ftp://mirror.internode.on.net/pub/cygwin/http",
"ftp://mirror.lagoon.nc/cygwin/r",
"ftp://mirror.rise.ph/cygwin/cygwin/http",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/https://",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/https://mirror",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/win/httpsC",
"ftp://mirrors.netix.net/cygwin/http://f",
"ftp://mirrors.netix.net/cygwin/http://m",
"ftp://mirrors.syringanetworks.net/cygwin/https://",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/https://",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/in/http://w",
"ftp://sunsite.icm.edu.plp",
"http://acedicom.edicomgroup.com/doc0",
"http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?",
"http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://ca.disig.sk/ca/crl/ca_disig.crl0",
"http://certificates.starfieldtech.com/repository/1604",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://cps.siths.se/sithsrootcav1.html0",
"http://crl.comodoca.com/AAACertificateServices.crl06",
"http://crl.defence.gov.au/pki0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://crl.oces.trust2408.com/oces.crl0",
"http://crl.securetrust.com/STCA.crl0",
"http://crl.ssc.lt/root-a/cacrl.crl0",
"http://crl.ssc.lt/root-c/cacrl.crl0",
"http://crl.xrampsecurity.com/XGCA.crl0",
"http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enI",
"http://ctldl.windowsupdate.com:80",
"http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org.ed",
"http://cygwin.cathedral-networks.org.sj",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/#5",
"http://cygwin.cathedral-networks.org/$",
"http://cygwin.cathedral-networks.org/)5",
"http://cygwin.cathedral-networks.org/-",
"http://cygwin.cathedral-networks.org/-u",
"http://cygwin.cathedral-networks.org/.i",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org//;",
"http://cygwin.cathedral-networks.org//J7",
"http://cygwin.cathedral-networks.org//V",
"http://cygwin.cathedral-networks.org//c4",
"http://cygwin.cathedral-networks.org//f",
"http://cygwin.cathedral-networks.org//fU",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org/0",
"http://cygwin.cathedral-networks.org/5",
"http://cygwin.cathedral-networks.org/57I",
"http://cygwin.cathedral-networks.org/6",
"http://cygwin.cathedral-networks.org/9",
"http://cygwin.cathedral-networks.org/:",
"http://cygwin.cathedral-networks.org/;",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/=",
"http://cygwin.cathedral-networks.org/A",
"http://cygwin.cathedral-networks.org/B6",
"http://cygwin.cathedral-networks.org/D",
"http://cygwin.cathedral-networks.org/G",
"http://cygwin.cathedral-networks.org/I",
"http://cygwin.cathedral-networks.org/I5",
"http://cygwin.cathedral-networks.org/I6",
"http://cygwin.cathedral-networks.org/K",
"http://cygwin.cathedral-networks.org/M",
"http://cygwin.cathedral-networks.org/N",
"http://cygwin.cathedral-networks.org/N;",
"http://cygwin.cathedral-networks.org/S",
"http://cygwin.cathedral-networks.org/Un",
"http://cygwin.cathedral-networks.org/W0",
"http://cygwin.cathedral-networks.org/X",
"http://cygwin.cathedral-networks.org/Y",
"http://cygwin.cathedral-networks.org/Z",
"http://cygwin.cathedral-networks.org/a",
"http://cygwin.cathedral-networks.org/aN",
"http://cygwin.cathedral-networks.org/aren.net",
"http://cygwin.cathedral-networks.org/d",
"http://cygwin.cathedral-networks.org/d4t",
"http://cygwin.cathedral-networks.org/de",
"http://cygwin.cathedral-networks.org/dk",
"http://cygwin.cathedral-networks.org/ec",
"http://cygwin.cathedral-networks.org/edV",
"http://cygwin.cathedral-networks.org/en;",
"http://cygwin.cathedral-networks.org/er",
"http://cygwin.cathedral-networks.org/fr",
"http://cygwin.cathedral-networks.org/ft",
"http://cygwin.cathedral-networks.org/ftz",
"http://cygwin.cathedral-networks.org/g",
"http://cygwin.cathedral-networks.org/ha",
"http://cygwin.cathedral-networks.org/i",
"http://cygwin.cathedral-networks.org/i-s",
"http://cygwin.cathedral-networks.org/ii",
"http://cygwin.cathedral-networks.org/in-",
"http://cygwin.cathedral-networks.org/k",
"http://cygwin.cathedral-networks.org/lb",
"http://cygwin.cathedral-networks.org/li",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/mam",
"http://cygwin.cathedral-networks.org/mi",
"http://cygwin.cathedral-networks.org/n/",
"http://cygwin.cathedral-networks.org/no",
"http://cygwin.cathedral-networks.org/ork",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/p.k3x",
"http://cygwin.cathedral-networks.org/q",
"http://cygwin.cathedral-networks.org/ra",
"http://cygwin.cathedral-networks.org/ren.net0",
"http://cygwin.cathedral-networks.org/rk",
"http://cygwin.cathedral-networks.org/s",
"http://cygwin.cathedral-networks.org/s/l3",
"http://cygwin.cathedral-networks.org/sr",
"http://cygwin.cathedral-networks.org/t",
"http://cygwin.cathedral-networks.org/t$",
"http://cygwin.cathedral-networks.org/te",
"http://cygwin.cathedral-networks.org/th",
"http://cygwin.cathedral-networks.org/tt",
"http://cygwin.cathedral-networks.org/unU",
"http://cygwin.cathedral-networks.org/us",
"http://cygwin.cathedral-networks.org/w",
"http://cygwin.cathedral-networks.org/wa",
"http://cygwin.cathedral-networks.org/x",
"http://cygwin.cathedral-networks.org/ygX",
"http://cygwin.cathedral-networks.org/yn",
"http://cygwin.cathedral-networks.org/z6",
"http://cygwin.cathedral-networks.org/~",
"http://cygwin.cathedral-networks.org2/",
"http://cygwin.cathedral-networks.org29I",
"http://cygwin.cathedral-networks.org63",
"http://cygwin.cathedral-networks.org9",
"http://cygwin.cathedral-networks.org://",
"http://cygwin.cathedral-networks.orgB2",
"http://cygwin.cathedral-networks.orgC",
"http://cygwin.cathedral-networks.orgF5",
"http://cygwin.cathedral-networks.orgI",
"http://cygwin.cathedral-networks.orgI7",
"http://cygwin.cathedral-networks.orgL9",
"http://cygwin.cathedral-networks.orgN",
"http://cygwin.cathedral-networks.orgT6h",
"http://cygwin.cathedral-networks.orgZ",
"http://cygwin.cathedral-networks.orga-u",
"http://cygwin.cathedral-networks.orgain",
"http://cygwin.cathedral-networks.orgalaW",
"http://cygwin.cathedral-networks.orgb",
"http://cygwin.cathedral-networks.orgd",
"http://cygwin.cathedral-networks.orge",
"http://cygwin.cathedral-networks.orge.",
"http://cygwin.cathedral-networks.orgeyq",
"http://cygwin.cathedral-networks.orgf",
"http://cygwin.cathedral-networks.orgf;t",
"http://cygwin.cathedral-networks.orgflyI",
"http://cygwin.cathedral-networks.orggwi",
"http://cygwin.cathedral-networks.orgia",
"http://cygwin.cathedral-networks.orgin/",
"http://cygwin.cathedral-networks.orgjp",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgn/T",
"http://cygwin.cathedral-networks.orgnc",
"http://cygwin.cathedral-networks.orgnux",
"http://cygwin.cathedral-networks.orgon",
"http://cygwin.cathedral-networks.orgp.lO3",
"http://cygwin.cathedral-networks.orgp/p",
"http://cygwin.cathedral-networks.orgr.c",
"http://cygwin.cathedral-networks.orgrs.-",
"http://cygwin.cathedral-networks.orgsde",
"http://cygwin.cathedral-networks.orgt",
"http://cygwin.cathedral-networks.orgtac",
"http://cygwin.cathedral-networks.orguni",
"http://cygwin.cathedral-networks.orguts",
"http://cygwin.cathedral-networks.orgwin",
"http://cygwin.cathedral-networks.org~",
"http://cygwin.cathedral-y",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk#",
"http://cygwin.mbwarez.dk$",
"http://cygwin.mbwarez.dk-",
"http://cygwin.mbwarez.dk.ac.jp/n/",
"http://cygwin.mbwarez.dk.de",
"http://cygwin.mbwarez.dk.de.dein/b",
"http://cygwin.mbwarez.dk.de/cygwin/.ma",
"http://cygwin.mbwarez.dk.de/cygwin//",
"http://cygwin.mbwarez.dk.de/cygwin/ter6",
"http://cygwin.mbwarez.dk.orgru.com/cyg",
"http://cygwin.mbwarez.dk.orguib.no/",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/&",
"http://cygwin.mbwarez.dk/.",
"http://cygwin.mbwarez.dk/.ac.nz//.",
"http://cygwin.mbwarez.dk/.ca//cygwin/9",
"http://cygwin.mbwarez.dk/.cn/cygwin//",
"http://cygwin.mbwarez.dk/.csclub.uwa",
"http://cygwin.mbwarez.dk/.de",
"http://cygwin.mbwarez.dk/.de/cygwin/;",
"http://cygwin.mbwarez.dk/.internode.Y",
"http://cygwin.mbwarez.dk/.net",
"http://cygwin.mbwarez.dk/.rise.phj.O",
"http://cygwin.mbwarez.dk/.tu",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk///",
"http://cygwin.mbwarez.dk///in32/",
"http://cygwin.mbwarez.dk///sunsite.icm.",
"http://cygwin.mbwarez.dk//_",
"http://cygwin.mbwarez.dk//c",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin//",
"http://cygwin.mbwarez.dk//cygwin///m",
"http://cygwin.mbwarez.dk//cygwin//b",
"http://cygwin.mbwarez.dk//cygwin/i-L",
"http://cygwin.mbwarez.dk//cygwin/t/",
"http://cygwin.mbwarez.dk//cygwin32/",
"http://cygwin.mbwarez.dk//gwin//",
"http://cygwin.mbwarez.dk//in/y",
"http://cygwin.mbwarez.dk//n/in/scW",
"http://cygwin.mbwarez.dk//n/tps://N",
"http://cygwin.mbwarez.dk//sourceware.oT",
"http://cygwin.mbwarez.dk//win/://(",
"http://cygwin.mbwarez.dk//ygwin/",
"http://cygwin.mbwarez.dk/0",
"http://cygwin.mbwarez.dk/52",
"http://cygwin.mbwarez.dk/:",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/=;2",
"http://cygwin.mbwarez.dk/A",
"http://cygwin.mbwarez.dk/I",
"http://cygwin.mbwarez.dk/P",
"http://cygwin.mbwarez.dk/Z",
"http://cygwin.mbwarez.dk/alasiaw",
"http://cygwin.mbwarez.dk/at/cygwin//",
"http://cygwin.mbwarez.dk/aujp",
"http://cygwin.mbwarez.dk/auwin/n/",
"http://cygwin.mbwarez.dk/auygwin/9",
"http://cygwin.mbwarez.dk/b/cygwin/ors.a",
"http://cygwin.mbwarez.dk/bly.com/",
"http://cygwin.mbwarez.dk/bochum.denc",
"http://cygwin.mbwarez.dk/cn/cygwin/",
"http://cygwin.mbwarez.dk/cyg",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin//",
"http://cygwin.mbwarez.dk/cygwin//m",
"http://cygwin.mbwarez.dk/cygwin//n/Y",
"http://cygwin.mbwarez.dk/cygwin//w",
"http://cygwin.mbwarez.dk/cygwin/;",
"http://cygwin.mbwarez.dk/cygwin/g",
"http://cygwin.mbwarez.dk/cygwin/gwin/",
"http://cygwin.mbwarez.dk/cygwin/ina",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/n/a",
"http://cygwin.mbwarez.dk/cygwin/n/sof",
"http://cygwin.mbwarez.dk/cygwin/n32/Z4",
"http://cygwin.mbwarez.dk/cygwin/nc/W",
"http://cygwin.mbwarez.dk/cygwin/r",
"http://cygwin.mbwarez.dk/cygwin/wtho",
"http://cygwin.mbwarez.dk/de",
"http://cygwin.mbwarez.dk/de/cygwin/",
"http://cygwin.mbwarez.dk/de/cygwin/ft",
"http://cygwin.mbwarez.dk/dein/",
"http://cygwin.mbwarez.dk/e.phs",
"http://cygwin.mbwarez.dk/et/cygwin/",
"http://cygwin.mbwarez.dk/et/cygwin/gwiy7",
"http://cygwin.mbwarez.dk/et/cygwin/ttp",
"http://cygwin.mbwarez.dk/et://mirrors.s",
"http://cygwin.mbwarez.dk/et://www.guts",
"http://cygwin.mbwarez.dk/etn/r.easyn",
"http://cygwin.mbwarez.dk/etworks.org",
"http://cygwin.mbwarez.dk/f",
"http://cygwin.mbwarez.dk/fly.bydem$",
"http://cygwin.mbwarez.dk/g/cygwin/m",
"http://cygwin.mbwarez.dk/garr.iti2g",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin/(",
"http://cygwin.mbwarez.dk/gwin/.de",
"http://cygwin.mbwarez.dk/gwin//",
"http://cygwin.mbwarez.dk/gwin//sd",
"http://cygwin.mbwarez.dk/gwin/a://",
"http://cygwin.mbwarez.dk/gwin/edral",
"http://cygwin.mbwarez.dk/gwin/in/",
"http://cygwin.mbwarez.dk/gwin/n/",
"http://cygwin.mbwarez.dk/gwin/o",
"http://cygwin.mbwarez.dk/gwin/win/_",
"http://cygwin.mbwarez.dk/hen.dein/H",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in//",
"http://cygwin.mbwarez.dk/in///",
"http://cygwin.mbwarez.dk/in/in/",
"http://cygwin.mbwarez.dk/in/in/.ca",
"http://cygwin.mbwarez.dk/in/n/n/B",
"http://cygwin.mbwarez.dk/isboa.ptG",
"http://cygwin.mbwarez.dk/j",
"http://cygwin.mbwarez.dk/loo.ca",
"http://cygwin.mbwarez.dk/ly.com/rg/e",
"http://cygwin.mbwarez.dk/m/cygwin/",
"http://cygwin.mbwarez.dk/m/cygwin/-",
"http://cygwin.mbwarez.dk/m/cygwin//q",
"http://cygwin.mbwarez.dk/mwin/gwin/g",
"http://cygwin.mbwarez.dk/n.uib.no/u",
"http://cygwin.mbwarez.dk/n/",
"http://cygwin.mbwarez.dk/n/cygwin/Y",
"http://cygwin.mbwarez.dk/n/gwin/z",
"http://cygwin.mbwarez.dk/n/n/et/",
"http://cygwin.mbwarez.dk/n/t",
"http://cygwin.mbwarez.dk/n/win/",
"http://cygwin.mbwarez.dk/n/win/win/V1",
"http://cygwin.mbwarez.dk/n/ygwin/",
"http://cygwin.mbwarez.dk/nadu.cne",
"http://cygwin.mbwarez.dk/netpn",
"http://cygwin.mbwarez.dk/ng",
"http://cygwin.mbwarez.dk/o",
"http://cygwin.mbwarez.dk/ochum.de.jp",
"http://cygwin.mbwarez.dk/ode.on.net/Z7",
"http://cygwin.mbwarez.dk/om/cygwin/",
"http://cygwin.mbwarez.dk/om/cygwin/c",
"http://cygwin.mbwarez.dk/omain.de/cygwi",
"http://cygwin.mbwarez.dk/omain.deli",
"http://cygwin.mbwarez.dk/omm.de/",
"http://cygwin.mbwarez.dk/pub/cygwin/",
"http://cygwin.mbwarez.dk/pub/software/0",
"http://cygwin.mbwarez.dk/rg",
"http://cygwin.mbwarez.dk/rg.il",
"http://cygwin.mbwarez.dk/rg/88",
"http://cygwin.mbwarez.dk/rg/cygwin/",
"http://cygwin.mbwarez.dk/rlands",
"http://cygwin.mbwarez.dk/rors/cygwin/",
"http://cygwin.mbwarez.dk/rror.isoc.o",
"http://cygwin.mbwarez.dk/rror/cygwin/",
"http://cygwin.mbwarez.dk/rror/cygwin/h",
"http://cygwin.mbwarez.dk/rrors.163.com",
"http://cygwin.mbwarez.dk/rrors.filigran",
"http://cygwin.mbwarez.dk/rrors.neti",
"http://cygwin.mbwarez.dk/rs.sjtug.sj",
"http://cygwin.mbwarez.dk/s",
"http://cygwin.mbwarez.dk/s/cygwin//",
"http://cygwin.mbwarez.dk/soft",
"http://cygwin.mbwarez.dk/t",
"http://cygwin.mbwarez.dk/t/cygwin/",
"http://cygwin.mbwarez.dk/t/ks.org",
"http://cygwin.mbwarez.dk/tft.edu.cn/cy",
"http://cygwin.mbwarez.dk/tp",
"http://cygwin.mbwarez.dk/tworks.org/.n",
"http://cygwin.mbwarez.dk/u.cn/cygwin/",
"http://cygwin.mbwarez.dk/ub/cygwin/I",
"http://cygwin.mbwarez.dk/ux.rz.ruhr-un",
"http://cygwin.mbwarez.dk/win.uib.no/",
"http://cygwin.mbwarez.dk/win/",
"http://cygwin.mbwarez.dk/win/.de6",
"http://cygwin.mbwarez.dk/win//",
"http://cygwin.mbwarez.dk/win/are.or",
"http://cygwin.mbwarez.dk/win/gwin/",
"http://cygwin.mbwarez.dk/win/ia"
],
"description": "URLs found in memory or binary data",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "7058",
"match_data": [
"8.43.85.97:443 -> 192.168.2.15:49717 version: TLS 1.2"
],
"description": "Uses secure TLS version for HTTPS connections",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"description": "Uses HTTPS",
"match_data": [
"HTTP traffic on port 49698 -> 443",
"HTTP traffic on port 443 -> 49698"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "625"
},
{
"refs": [
{
"ref": "#memory_dumps",
"value": "file.exe, 00000000.00000002.2766071892.0000000000D26000.00000004.00000020.00020000.00000000.sdmp"
},
{
"ref": "#memory_dumps",
"value": "file.exe, 00000000.00000002.2766071892.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2765349898.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp"
}
],
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)",
"match_data": [
"Hyper-V RAW{",
"Hyper-V RAW"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "263"
},
{
"description": "URLs found in memory or binary data",
"match_data": [
"ftp://cygwin.mirror.rafal.catp",
"ftp://ftp.byfly.by/pub/cygwin/irror",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://c",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/https://",
"ftp://ftp.fau.de/cygwin/",
"ftp://ftp.fau.de/cygwin/://mirror.dogado.de",
"ftp://ftp.fau.de/cygwin/ygwin/https://",
"ftp://ftp.fau.des",
"ftp://ftp.fs",
"ftp://ftp.fsN",
"ftp://ftp.fsn.hu/pub/cygwin/gwin",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin//https:///",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/mirror",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/tp",
"ftp://ftp.funet.fihttp:",
"ftp://ftp.halifax.rwth-aachen.de/cygwin//in",
"ftp://ftp.iij.ad.jp/pub/cygwin/de",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://l",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://m",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://3",
"ftp://ftp.jaist.ac.jp/pub/cygwin/",
"ftp://ftp.kr.freebsd.org/pub/cygwin",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://",
"ftp://ftp.kr.freebsd.orglhttps://",
"ftp://ftp.l",
"ftp://ftp.lip6.fr/pub/cygwin/https://ft",
"ftp://ftp.n",
"ftp://ftp.ntua.grhttp:",
"ftp://ftp.snt.utwente.nl/pub/software/cygwin/https://",
"ftp://ftp.yz.yamagata-u.ac.jp",
"ftp://ftp.yz.yamagata-u.ac.jpp",
"ftp://mirror.checkdomain.de/cygwin/cygwin",
"ftp://mirror.checkdomain.demirror",
"ftp://mirror.datacenter.bygchhttp://mZ",
"ftp://mirror.datacenter.byhum.de",
"ftp://mirror.easyname.at/cygwin/larushttps://",
"ftp://mirror.internode.on.net/pub/cygwin/http",
"ftp://mirror.lagoon.nc/cygwin/https://I",
"ftp://mirrors.dotsrc.org/mirrors/cygwin//cygwin/",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/gwin",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/http://c/",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/https://",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/or",
"ftp://mirrors.netix.net/cygwin/http://fZ",
"ftp://mirrors.sonic.net/cygwin/in/httP",
"ftp://mirrors.syringanetworks.net/cygwin/gwin/https://w",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/https://",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/mirror",
"http://ac.economia.gob.mx/cps.html0",
"http://ac.economia.gob.mx/last.crl0G",
"http://acedicom.edicomgroup.com/doc0",
"http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?",
"http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0",
"http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://ca.disig.sk/ca/crl/ca_disig.crl0",
"http://ca.mtin.es/mtin/DPCyPoliticas0",
"http://ca.mtin.es/mtin/DPCyPoliticas0g",
"http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03",
"http://ca.mtin.es/mtin/ocsp0",
"http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0",
"http://certificates.starfieldtech.com/repository/1604",
"http://certs.oati.net/repository/OATICA2.crl0",
"http://certs.oati.net/repository/OATICA2.crt0",
"http://certs.oaticerts.com/repository/OATICA2.crl",
"http://certs.oaticerts.com/repository/OATICA2.crt08",
"http://cps.chambersign.org/cps/chambersignroot.html0",
"http://cps.chambersign.org/cps/chambersroot.html0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://cps.siths.se/sithsrootcav1.html0",
"http://crl.certigna.fr/certignarootca.crl01",
"http://crl.chambersign.org/chambersignroot.crl0",
"http://crl.chambersign.org/chambersroot.crl0",
"http://crl.comodoca.com/AAACertificateServices.crl06",
"http://crl.defence.gov.au/pki0",
"http://crl.dhimyotis.com/certignarootca.crl0",
"http://crl.globalsign.net/root-r2.crl0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://crl.oces.trust2408.com/oces.crl0",
"http://crl.securetrust.com/SGCA.crl0",
"http://crl.securetrust.com/STCA.crl0",
"http://crl.ssc.lt/root-a/cacrl.crl0",
"http://crl.ssc.lt/root-b/cacrl.crl0",
"http://crl.ssc.lt/root-c/cacrl.crl0",
"http://crl.xrampsecurity.com/XGCA.crl0",
"http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0",
"http://ctldl.windowsupdate.com/",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enR5",
"http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org.v",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/%",
"http://cygwin.cathedral-networks.org/)",
"http://cygwin.cathedral-networks.org/-",
"http://cygwin.cathedral-networks.org/.",
"http://cygwin.cathedral-networks.org/.c",
"http://cygwin.cathedral-networks.org/.i",
"http://cygwin.cathedral-networks.org/.l",
"http://cygwin.cathedral-networks.org/.m",
"http://cygwin.cathedral-networks.org/.n",
"http://cygwin.cathedral-networks.org/.s",
"http://cygwin.cathedral-networks.org/.u8",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org//)",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org//D",
"http://cygwin.cathedral-networks.org//Z",
"http://cygwin.cathedral-networks.org//c",
"http://cygwin.cathedral-networks.org//f",
"http://cygwin.cathedral-networks.org//f:",
"http://cygwin.cathedral-networks.org//ftp.ntu.edu.twI",
"http://cygwin.cathedral-networks.org//l",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org//u",
"http://cygwin.cathedral-networks.org/8",
"http://cygwin.cathedral-networks.org/9",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/B",
"http://cygwin.cathedral-networks.org/C",
"http://cygwin.cathedral-networks.org/F",
"http://cygwin.cathedral-networks.org/G",
"http://cygwin.cathedral-networks.org/K",
"http://cygwin.cathedral-networks.org/L",
"http://cygwin.cathedral-networks.org/X",
"http://cygwin.cathedral-networks.org/Z",
"http://cygwin.cathedral-networks.org/a",
"http://cygwin.cathedral-networks.org/an",
"http://cygwin.cathedral-networks.org/at3",
"http://cygwin.cathedral-networks.org/c",
"http://cygwin.cathedral-networks.org/ck",
"http://cygwin.cathedral-networks.org/cy",
"http://cygwin.cathedral-networks.org/d",
"http://cygwin.cathedral-networks.org/dO",
"http://cygwin.cathedral-networks.org/e",
"http://cygwin.cathedral-networks.org/e.",
"http://cygwin.cathedral-networks.org/ee.",
"http://cygwin.cathedral-networks.org/en",
"http://cygwin.cathedral-networks.org/f",
"http://cygwin.cathedral-networks.org/fr",
"http://cygwin.cathedral-networks.org/fs",
"http://cygwin.cathedral-networks.org/ft",
"http://cygwin.cathedral-networks.org/g",
"http://cygwin.cathedral-networks.org/h",
"http://cygwin.cathedral-networks.org/hti",
"http://cygwin.cathedral-networks.org/i",
"http://cygwin.cathedral-networks.org/ic",
"http://cygwin.cathedral-networks.org/in",
"http://cygwin.cathedral-networks.org/ir",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/mG",
"http://cygwin.cathedral-networks.org/ma/",
"http://cygwin.cathedral-networks.org/mi",
"http://cygwin.cathedral-networks.org/miK",
"http://cygwin.cathedral-networks.org/n",
"http://cygwin.cathedral-networks.org/n/",
"http://cygwin.cathedral-networks.org/ni",
"http://cygwin.cathedral-networks.org/o",
"http://cygwin.cathedral-networks.org/oo",
"http://cygwin.cathedral-networks.org/ot",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/p:",
"http://cygwin.cathedral-networks.org/q",
"http://cygwin.cathedral-networks.org/r",
"http://cygwin.cathedral-networks.org/ro",
"http://cygwin.cathedral-networks.org/rs",
"http://cygwin.cathedral-networks.org/s.",
"http://cygwin.cathedral-networks.org/sj",
"http://cygwin.cathedral-networks.org/su",
"http://cygwin.cathedral-networks.org/tp",
"http://cygwin.cathedral-networks.org/tt",
"http://cygwin.cathedral-networks.org/u",
"http://cygwin.cathedral-networks.org/um",
"http://cygwin.cathedral-networks.org/v",
"http://cygwin.cathedral-networks.org/w",
"http://cygwin.cathedral-networks.org/wa(",
"http://cygwin.cathedral-networks.org0",
"http://cygwin.cathedral-networks.org6",
"http://cygwin.cathedral-networks.org;",
"http://cygwin.cathedral-networks.orgE",
"http://cygwin.cathedral-networks.orgH",
"http://cygwin.cathedral-networks.orgL",
"http://cygwin.cathedral-networks.orgR",
"http://cygwin.cathedral-networks.orgT",
"http://cygwin.cathedral-networks.orga",
"http://cygwin.cathedral-networks.orgb/c",
"http://cygwin.cathedral-networks.orgcew",
"http://cygwin.cathedral-networks.orgcom",
"http://cygwin.cathedral-networks.orgcyg",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgom",
"http://cygwin.cathedral-networks.orgorg3",
"http://cygwin.cathedral-networks.orgror%",
"http://cygwin.cathedral-networks.orgsde",
"http://cygwin.cathedral-networks.orgt",
"http://cygwin.cathedral-networks.orgtp:",
"http://cygwin.cathedral-networks.orgtpsP",
"http://cygwin.cathedral-networks.orgtsc",
"http://cygwin.cathedral-networks.orguts",
"http://cygwin.cathedral-networks.orgwin",
"http://cygwin.cathedral-networks.orgxmi",
"http://cygwin.mbwarez",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk.by.fr-",
"http://cygwin.mbwarez.dk.byfly.byo?",
"http://cygwin.mbwarez.dk.den/win//:",
"http://cygwin.mbwarez.dk.koddos.netet5",
"http://cygwin.mbwarez.dk.netgwin/g/",
"http://cygwin.mbwarez.dk.netpt",
"http://cygwin.mbwarez.dk.ntu.edu.tw/pub",
"http://cygwin.mbwarez.dk.rnl.tecnico.ulB",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/%",
"http://cygwin.mbwarez.dk/(",
"http://cygwin.mbwarez.dk/-",
"http://cygwin.mbwarez.dk/.ca/",
"http://cygwin.mbwarez.dk/.ca/afal.ca?",
"http://cygwin.mbwarez.dk/.cn/cygwin/ft",
"http://cygwin.mbwarez.dk/.cnwin/n/",
"http://cygwin.mbwarez.dk/.com/cygwin/",
"http://cygwin.mbwarez.dk/.de/cygwin/gw",
"http://cygwin.mbwarez.dk/.edu.cnJ",
"http://cygwin.mbwarez.dk/.hunet",
"http://cygwin.mbwarez.dk/.netin/n.net",
"http://cygwin.mbwarez.dk/.nz/",
"http://cygwin.mbwarez.dk/.sjtu.edu.c",
"http://cygwin.mbwarez.dk/.ustc.edu.$",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk///",
"http://cygwin.mbwarez.dk///mirrors.dots",
"http://cygwin.mbwarez.dk///tps://",
"http://cygwin.mbwarez.dk//0e",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin/$",
"http://cygwin.mbwarez.dk//cygwin/.d",
"http://cygwin.mbwarez.dk//cygwin//",
"http://cygwin.mbwarez.dk//cygwin/O",
"http://cygwin.mbwarez.dk//cygwin32/",
"http://cygwin.mbwarez.dk//gwin/",
"http://cygwin.mbwarez.dk//gwin//",
"http://cygwin.mbwarez.dk//in/ca/",
"http://cygwin.mbwarez.dk//in/win/",
"http://cygwin.mbwarez.dk//mirror.koddos5",
"http://cygwin.mbwarez.dk//mn/",
"http://cygwin.mbwarez.dk//n/et",
"http://cygwin.mbwarez.dk//n/w.gutscheinrausch.de/mirror/cygwin/",
"http://cygwin.mbwarez.dk//pub/cygwin/",
"http://cygwin.mbwarez.dk//win/.",
"http://cygwin.mbwarez.dk/0",
"http://cygwin.mbwarez.dk/2",
"http://cygwin.mbwarez.dk/3",
"http://cygwin.mbwarez.dk/7J",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/Asiaon",
"http://cygwin.mbwarez.dk/B",
"http://cygwin.mbwarez.dk/E",
"http://cygwin.mbwarez.dk/Europec",
"http://cygwin.mbwarez.dk/North",
"http://cygwin.mbwarez.dk/Norway",
"http://cygwin.mbwarez.dk/Poland.",
"http://cygwin.mbwarez.dk/V)",
"http://cygwin.mbwarez.dk/achen.de1",
"http://cygwin.mbwarez.dk/aledonia",
"http://cygwin.mbwarez.dk/ant.com",
"http://cygwin.mbwarez.dk/b",
"http://cygwin.mbwarez.dk/b/cygwin/te.n",
"http://cygwin.mbwarez.dk/chen.",
"http://cygwin.mbwarez.dk/chum.de",
"http://cygwin.mbwarez.dk/cn/cygwin/",
"http://cygwin.mbwarez.dk/com/cygwin/d",
"http://cygwin.mbwarez.dk/cyg",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin/(",
"http://cygwin.mbwarez.dk/cygwin//",
"http://cygwin.mbwarez.dk/cygwin//.",
"http://cygwin.mbwarez.dk/cygwin//9",
"http://cygwin.mbwarez.dk/cygwin//b",
"http://cygwin.mbwarez.dk/cygwin/7",
"http://cygwin.mbwarez.dk/cygwin/://",
"http://cygwin.mbwarez.dk/cygwin/A",
"http://cygwin.mbwarez.dk/cygwin/I",
"http://cygwin.mbwarez.dk/cygwin/n/n/",
"http://cygwin.mbwarez.dk/cygwin/rror.l",
"http://cygwin.mbwarez.dk/cygwin32/",
"http://cygwin.mbwarez.dk/d.com",
"http://cygwin.mbwarez.dk/d.comwin/on",
"http://cygwin.mbwarez.dk/de/cygwin/",
"http://cygwin.mbwarez.dk/de/cygwin/tsr",
"http://cygwin.mbwarez.dk/deygwin/(",
"http://cygwin.mbwarez.dk/e",
"http://cygwin.mbwarez.dk/e/cygwin/",
"http://cygwin.mbwarez.dk/e/cygwin/in/",
"http://cygwin.mbwarez.dk/e/software/win",
"http://cygwin.mbwarez.dk/ebsd.orgc.jp",
"http://cygwin.mbwarez.dk/et/cygwin/",
"http://cygwin.mbwarez.dk/et/cygwin/y",
"http://cygwin.mbwarez.dk/etcygwin/",
"http://cygwin.mbwarez.dk/etworks.org)",
"http://cygwin.mbwarez.dk/etworks.org/",
"http://cygwin.mbwarez.dk/f",
"http://cygwin.mbwarez.dk/ftp://mi",
"http://cygwin.mbwarez.dk/g/cygwin/",
"http://cygwin.mbwarez.dk/g/cygwin/:",
"http://cygwin.mbwarez.dk/gasso.netd",
"http://cygwin.mbwarez.dk/gwin",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin///",
"http://cygwin.mbwarez.dk/gwin/gwin/",
"http://cygwin.mbwarez.dk/gwin/n/",
"http://cygwin.mbwarez.dk/gwin/n//m",
"http://cygwin.mbwarez.dk/gwin/n/x",
"http://cygwin.mbwarez.dk/gwin/o.net/K",
"http://cygwin.mbwarez.dk/gwin/ps://w",
"http://cygwin.mbwarez.dk/gwin/t",
"http://cygwin.mbwarez.dk/gwin/win/",
"http://cygwin.mbwarez.dk/gygwin/#",
"http://cygwin.mbwarez.dk/h.de//n/",
"http://cygwin.mbwarez.dk/h.deEurope",
"http://cygwin.mbwarez.dk/hen.de",
"http://cygwin.mbwarez.dk/https://",
"http://cygwin.mbwarez.dk/hum.degwin/&",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in//",
"http://cygwin.mbwarez.dk/in//Q",
"http://cygwin.mbwarez.dk/in//win/$",
"http://cygwin.mbwarez.dk/in/cygwin/",
"http://cygwin.mbwarez.dk/in/cygwin/E",
"http://cygwin.mbwarez.dk/in/cygwin/che",
"http://cygwin.mbwarez.dk/in/gwin/",
"http://cygwin.mbwarez.dk/in/in/",
"http://cygwin.mbwarez.dk/in/in/t.e~",
"http://cygwin.mbwarez.dk/in/p.br/cy",
"http://cygwin.mbwarez.dk/in/tp://ftp.l",
"http://cygwin.mbwarez.dk/in/win/",
"http://cygwin.mbwarez.dk/in/win/W",
"http://cygwin.mbwarez.dk/in/ygwin/I",
"http://cygwin.mbwarez.dk/in/ygwin/a",
"http://cygwin.mbwarez.dk/isboa.pt/pub/c",
"http://cygwin.mbwarez.dk/ited",
"http://cygwin.mbwarez.dk/k",
"http://cygwin.mbwarez.dk/l",
"http://cygwin.mbwarez.dk/m/cygwin/",
"http://cygwin.mbwarez.dk/m/cygwin/://cy",
"http://cygwin.mbwarez.dk/min/Av",
"http://cygwin.mbwarez.dk/n.viem-it.n",
"http://cygwin.mbwarez.dk/n/",
"http://cygwin.mbwarez.dk/n/cygwin/",
"http://cygwin.mbwarez.dk/n/gwi",
"http://cygwin.mbwarez.dk/n/in32/",
"http://cygwin.mbwarez.dk/n/win/",
"http://cygwin.mbwarez.dk/n?",
"http://cygwin.mbwarez.dk/ncent.comcom",
"http://cygwin.mbwarez.dk/ng",
"http://cygwin.mbwarez.dk/no/cygwin/",
"http://cygwin.mbwarez.dk/ogwin/",
"http://cygwin.mbwarez.dk/om/cygwin/",
"http://cygwin.mbwarez.dk/om/cygwin/(",
"http://cygwin.mbwarez.dk/om/cygwin/J",
"http://cygwin.mbwarez.dk/om/cygwin/P",
"http://cygwin.mbwarez.dk/om/cygwin/n/",
"http://cygwin.mbwarez.dk/omain.de",
"http://cygwin.mbwarez.dk/oo",
"http://cygwin.mbwarez.dk/ope1",
"http://cygwin.mbwarez.dk/or.checkdomain",
"http://cygwin.mbwarez.dk/orgb/cygwin/",
"http://cygwin.mbwarez.dk/orgomgwin/I",
"http://cygwin.mbwarez.dk/ors.do",
"http://cygwin.mbwarez.dk/p",
"http://cygwin.mbwarez.dk/p.fau.depdu",
"http://cygwin.mbwarez.dk/p.funet.fi/pub",
"http://cygwin.mbwarez.dk/pub/cygwin/",
"http://cygwin.mbwarez.dk/pub/cygwin/ft",
"http://cygwin.mbwarez.dk/r-hk.koddos",
"http://cygwin.mbwarez.dk/rafal.ca/S",
"http://cygwin.mbwarez.dk/rg/cygwin/",
"http://cygwin.mbwarez.dk/rg/pub/cygw",
"http://cygwin.mbwarez.dk/rgasso.net",
"http://cygwin.mbwarez.dk/rgasso.net/R",
"http://cygwin.mbwarez.dk/rloo.canet/",
"http://cygwin.mbwarez.dk/rrors.163.com",
"http://cygwin.mbwarez.dk/rz.ruhr-uni",
"http://cygwin.mbwarez.dk/s.netix.net",
"http://cygwin.mbwarez.dk/s/cygwin/",
"http://cygwin.mbwarez.dk/stralasiaagoo",
"http://cygwin.mbwarez.dk/t",
"http://cygwin.mbwarez.dk/t.comgwin/",
"http://cygwin.mbwarez.dk/t/cygwin/",
"http://cygwin.mbwarez.dk/t/cygwin/Unix/sourceware.org/cygwin//n/",
"http://cygwin.mbwarez.dk/t/cygwin/Y",
"http://cygwin.mbwarez.dk/t/cygwin/n/",
"http://cygwin.mbwarez.dk/tc.edu.cn",
"http://cygwin.mbwarez.dk/tgwin//usL",
"http://cygwin.mbwarez.dk/tn/://ftp.ha6",
"http://cygwin.mbwarez.dk/tp://ftp.fa"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "238"
},
{
"description": "Uses secure TLS version for HTTPS connections",
"match_data": [
"8.43.85.97:443 -> 192.168.2.13:49698 version: TLS 1.2"
],
"severity": "IMPACT_SEVERITY_INFO",
"id": "7058"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"HTTP traffic on port 443 -> 49711",
"HTTP traffic on port 49711 -> 443"
],
"id": "625",
"description": "Uses HTTPS"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"refs": [
{
"ref": "#memory_dumps",
"value": "program.exe, 00000000.00000002.4532740386.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, program.exe, 00000000.00000002.4532069778.0000000000D1C000.00000004.00000020.00020000.00000000.sdmp"
}
],
"match_data": [
"Hyper-V RAW"
],
"id": "263",
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"ftp://cygwin.mirror.rafal.ca",
"ftp://cygwin.mirror.rafal.caors",
"ftp://ftp-stud.hs-esslingen.de/pub/Mirrors/sources.redhat.com/cygwin/http://m",
"ftp://ftp-stud.hs-esslingen.deors",
"ftp://ftp-stud.hs-esslingen.deror",
"ftp://ftp.0",
"ftp://ftp.I?",
"ftp://ftp.byfly.by/pub/cygwin/",
"ftp://ftp.byfly.by/pub/cygwin//",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://f-",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://li60",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://m",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/https://",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/rs",
"ftp://ftp.fau.de",
"ftp://ftp.fau.de/cygwin/me",
"ftp://ftp.fs",
"ftp://ftp.fsn.hu/pub/cygwin/https://",
"ftp://ftp.fsn.hu/pub/cygwin/oc",
"ftp://ftp.fsn.hur",
"ftp://ftp.fst",
"ftp://ftp.ha",
"ftp://ftp.halifax.rwth-aachen.de",
"ftp://ftp.halifax.rwth-aachen.de/cygwin/",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://f",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://m",
"ftp://ftp.iij.ad.jp/pub/cygwin/or",
"ftp://ftp.iij.ad.jp/pub/cygwin/r",
"ftp://ftp.inf.tu-dresden.de/software/windows/cygwin32/http://m",
"ftp://ftp.inf.tu-dresden.demirror",
"ftp://ftp.jaist.ac.jp/pub/cygwin/https:",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://cj",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://mK1",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://",
"ftp://ftp.l",
"ftp://ftp.lip6.fr/pub/cygwin/",
"ftp://ftp.lip6.fr/pub/cygwin/http://f",
"ftp://ftp.lip6.fr/pub/cygwin/http://m~",
"ftp://ftp.lip6.fr/pub/cygwin/or",
"ftp://ftp.lip6.fr/pub/cygwin/p",
"ftp://ftp.lip6.fr/pub/cygwin/win",
"ftp://ftp.m",
"ftp://ftp.mirrorservice.org",
"ftp://ftp.n",
"ftp://ftp.np",
"ftp://ftp.ntu.edu.tw/pub/cygwin/",
"ftp://ftp.ntu.edu.tw/pub/cygwin//",
"ftp://ftp.ntua.gr",
"ftp://ftp.rnl.tecnico.ulisboa.pt",
"ftp://ftp.rnl.tecnico.ulisboa.pt/pub/cygwin/n/n",
"ftp://ftp.snt.utwente.nl/pub/software/cygwin/",
"ftp://ftp.snt.utwente.nlmcygwin",
"ftp://ftp.twaren.net/Unix/sourceware.org/cygwin/https::4",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/p",
"ftp://ftp.yz.yamagata-u.ac.jpor",
"ftp://linux.rz.ruhr-uni-bochum.de",
"ftp://mirror.checkdomain.de/cygwin/",
"ftp://mirror.checkdomain.de/cygwin/http://c?",
"ftp://mirror.checkdomain.de/cygwin/in/http://l",
"ftp://mirror.checkdomain.decygwin/httpY",
"ftp://mirror.checkdomain.dehttp://mirro",
"ftp://mirror.checkdomain.deirrors",
"ftp://mirror.cs.vt.edu/pub/cygwin/cygwin/",
"ftp://mirror.csclub.uwaterloo.ca/cygwin/httP",
"ftp://mirror.datacenter.by/pub/mirrors/cygwin/http://c",
"ftp://mirror.datacenter.byhttp://f",
"ftp://mirror.easyname.atz",
"ftp://mirror.internode.on.net/pub/cygwin/ygwin/",
"ftp://mirror.rise.ph/cygwin/cygwin/httpF4",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/st",
"ftp://mirrors.netix.net/cygwin/",
"ftp://mirrors.netix.net/cygwin//",
"ftp://mirrors.netix.net/cygwin/https://~",
"ftp://mirrors.netix.net/cygwin/or",
"ftp://mirrors.syringanetworks.net/cygwin/in/rs",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://ml",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/ygwin",
"ftp://sunsite.icm.edu.plhinahttp://ftp",
"ftp://sunsite.icm.edu.plhttp://f",
"ftp://sunsite.icm.edu.plnorg",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://cygwin.ca",
"http://cygwin.cathedral-",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org(",
"http://cygwin.cathedral-networks.org-",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/%",
"http://cygwin.cathedral-networks.org/&",
"http://cygwin.cathedral-networks.org/.",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org//&",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org//N)",
"http://cygwin.cathedral-networks.org//Z",
"http://cygwin.cathedral-networks.org//b5",
"http://cygwin.cathedral-networks.org//c",
"http://cygwin.cathedral-networks.org//f",
"http://cygwin.cathedral-networks.org//fy",
"http://cygwin.cathedral-networks.org//i6",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org/0",
"http://cygwin.cathedral-networks.org/1",
"http://cygwin.cathedral-networks.org/2/",
"http://cygwin.cathedral-networks.org/5G",
"http://cygwin.cathedral-networks.org/9/",
"http://cygwin.cathedral-networks.org/96",
"http://cygwin.cathedral-networks.org/9?",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/=",
"http://cygwin.cathedral-networks.org/A6",
"http://cygwin.cathedral-networks.org/C",
"http://cygwin.cathedral-networks.org/D",
"http://cygwin.cathedral-networks.org/G",
"http://cygwin.cathedral-networks.org/K(",
"http://cygwin.cathedral-networks.org/M",
"http://cygwin.cathedral-networks.org/P",
"http://cygwin.cathedral-networks.org/S(",
"http://cygwin.cathedral-networks.org/S.",
"http://cygwin.cathedral-networks.org/T",
"http://cygwin.cathedral-networks.org/T&",
"http://cygwin.cathedral-networks.org/U23",
"http://cygwin.cathedral-networks.org/X",
"http://cygwin.cathedral-networks.org/Y",
"http://cygwin.cathedral-networks.org/an:",
"http://cygwin.cathedral-networks.org/b/",
"http://cygwin.cathedral-networks.org/c",
"http://cygwin.cathedral-networks.org/c4/",
"http://cygwin.cathedral-networks.org/cn",
"http://cygwin.cathedral-networks.org/cy",
"http://cygwin.cathedral-networks.org/d",
"http://cygwin.cathedral-networks.org/e",
"http://cygwin.cathedral-networks.org/fr",
"http://cygwin.cathedral-networks.org/ft",
"http://cygwin.cathedral-networks.org/fts5",
"http://cygwin.cathedral-networks.org/h7",
"http://cygwin.cathedral-networks.org/ir",
"http://cygwin.cathedral-networks.org/l",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/m)",
"http://cygwin.cathedral-networks.org/m/",
"http://cygwin.cathedral-networks.org/mU",
"http://cygwin.cathedral-networks.org/mi",
"http://cygwin.cathedral-networks.org/mir4",
"http://cygwin.cathedral-networks.org/n&",
"http://cygwin.cathedral-networks.org/n.",
"http://cygwin.cathedral-networks.org/niK/",
"http://cygwin.cathedral-networks.org/o",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/rg",
"http://cygwin.cathedral-networks.org/s.",
"http://cygwin.cathedral-networks.org/s2",
"http://cygwin.cathedral-networks.org/sj",
"http://cygwin.cathedral-networks.org/sl",
"http://cygwin.cathedral-networks.org/t",
"http://cygwin.cathedral-networks.org/tsH",
"http://cygwin.cathedral-networks.org/u",
"http://cygwin.cathedral-networks.org/u.",
"http://cygwin.cathedral-networks.org/x",
"http://cygwin.cathedral-networks.org/z",
"http://cygwin.cathedral-networks.org/z%",
"http://cygwin.cathedral-networks.org/~",
"http://cygwin.cathedral-networks.org8",
"http://cygwin.cathedral-networks.orgA6",
"http://cygwin.cathedral-networks.orgC",
"http://cygwin.cathedral-networks.orgH",
"http://cygwin.cathedral-networks.orgK?",
"http://cygwin.cathedral-networks.orgS/",
"http://cygwin.cathedral-networks.orgW)",
"http://cygwin.cathedral-networks.org_2=",
"http://cygwin.cathedral-networks.orgd%",
"http://cygwin.cathedral-networks.orgdet5",
"http://cygwin.cathedral-networks.orgha",
"http://cygwin.cathedral-networks.orghtt",
"http://cygwin.cathedral-networks.orgk",
"http://cygwin.cathedral-networks.orgk3",
"http://cygwin.cathedral-networks.orgmi(q",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgn/N6",
"http://cygwin.cathedral-networks.orgoft",
"http://cygwin.cathedral-networks.orgorg",
"http://cygwin.cathedral-networks.orgp/p",
"http://cygwin.cathedral-networks.orgq",
"http://cygwin.cathedral-networks.orgrro",
"http://cygwin.cathedral-networks.orgsyn",
"http://cygwin.cathedral-networks.orgtp.",
"http://cygwin.cathedral-networks.orgttp&",
"http://cygwin.cathedral-networks.orgu",
"http://cygwin.cathedral-networks.orguwa",
"http://cygwin.cathedral-networks.orgw",
"http://cygwin.cathedral-networks.orgwar",
"http://cygwin.cathedral-networks.orgx",
"http://cygwin.cathedral-networks.orgy3&",
"http://cygwin.cathedral-networks.orgygw",
"http://cygwin.cathedral-networks.orgz",
"http://cygwin.cathedral-t5",
"http://cygwin.mbwarez",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk$",
"http://cygwin.mbwarez.dk$I)",
"http://cygwin.mbwarez.dk.ac.jpor",
"http://cygwin.mbwarez.dk.augwin//",
"http://cygwin.mbwarez.dk.by/pub/mirrors",
"http://cygwin.mbwarez.dk.cab/cygwin/v",
"http://cygwin.mbwarez.dk.iij.ad.jp/pub/",
"http://cygwin.mbwarez.dk.netm",
"http://cygwin.mbwarez.dk.orgin/",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/#",
"http://cygwin.mbwarez.dk/%",
"http://cygwin.mbwarez.dk/&",
"http://cygwin.mbwarez.dk/)",
"http://cygwin.mbwarez.dk/-uni-bochum",
"http://cygwin.mbwarez.dk/.can/org/",
"http://cygwin.mbwarez.dk/.cn/cygwin/i/",
"http://cygwin.mbwarez.dk/.cnom/",
"http://cygwin.mbwarez.dk/.co.za32/t",
"http://cygwin.mbwarez.dk/.de/cygwin/",
"http://cygwin.mbwarez.dk/.jp",
"http://cygwin.mbwarez.dk/.lagoon.nc",
"http://cygwin.mbwarez.dk/.lagoon.nc/",
"http://cygwin.mbwarez.dk/.nct",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk///",
"http://cygwin.mbwarez.dk////",
"http://cygwin.mbwarez.dk///cygwin/",
"http://cygwin.mbwarez.dk///win/",
"http://cygwin.mbwarez.dk//cygwi",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin//4",
"http://cygwin.mbwarez.dk//cygwin//b",
"http://cygwin.mbwarez.dk//cygwin/mi",
"http://cygwin.mbwarez.dk//cygwin/n/y",
"http://cygwin.mbwarez.dk//cygwin/rg",
"http://cygwin.mbwarez.dk//cygwin/ta",
"http://cygwin.mbwarez.dk//cygwin/v",
"http://cygwin.mbwarez.dk//cygwin/z",
"http://cygwin.mbwarez.dk//cygwin32/",
"http://cygwin.mbwarez.dk//cygwip",
"http://cygwin.mbwarez.dk//n/",
"http://cygwin.mbwarez.dk//u",
"http://cygwin.mbwarez.dk//win/com:",
"http://cygwin.mbwarez.dk//win/n/x",
"http://cygwin.mbwarez.dk//ygwin//c",
"http://cygwin.mbwarez.dk/4t",
"http://cygwin.mbwarez.dk/5T)",
"http://cygwin.mbwarez.dk/6",
"http://cygwin.mbwarez.dk/7",
"http://cygwin.mbwarez.dk/;",
"http://cygwin.mbwarez.dk/;cygwin.mbwarez.dk;Europe;Denmark;noshow",
"http://cygwin.mbwarez.dk/Asia",
"http://cygwin.mbwarez.dk/Asia/ft",
"http://cygwin.mbwarez.dk/Bulgaria",
"http://cygwin.mbwarez.dk/D1C",
"http://cygwin.mbwarez.dk/Europew",
"http://cygwin.mbwarez.dk/I",
"http://cygwin.mbwarez.dk/Moldova",
"http://cygwin.mbwarez.dk/P",
"http://cygwin.mbwarez.dk/S",
"http://cygwin.mbwarez.dk/U",
"http://cygwin.mbwarez.dk/United",
"http://cygwin.mbwarez.dk/ac.jp",
"http://cygwin.mbwarez.dk/ac.nz_",
"http://cygwin.mbwarez.dk/achen.deX",
"http://cygwin.mbwarez.dk/aren.neth-",
"http://cygwin.mbwarez.dk/argasso.net/a",
"http://cygwin.mbwarez.dk/auin/",
"http://cygwin.mbwarez.dk/auygwin//n",
"http://cygwin.mbwarez.dk/c.jpks.org",
"http://cygwin.mbwarez.dk/c/prog/cygwa",
"http://cygwin.mbwarez.dk/chum.de",
"http://cygwin.mbwarez.dk/cn/cygwin/D$",
"http://cygwin.mbwarez.dk/com/cygwin/",
"http://cygwin.mbwarez.dk/cyg",
"http://cygwin.mbwarez.dk/cygwin",
"http://cygwin.mbwarez.dk/cygwin/",
"http://cygwin.mbwarez.dk/cygwin/&",
"http://cygwin.mbwarez.dk/cygwin//G",
"http://cygwin.mbwarez.dk/cygwin/6",
"http://cygwin.mbwarez.dk/cygwin/Z",
"http://cygwin.mbwarez.dk/cygwin/in/s.",
"http://cygwin.mbwarez.dk/cygwin/ina",
"http://cygwin.mbwarez.dk/cygwin/n/",
"http://cygwin.mbwarez.dk/cygwin/tp:",
"http://cygwin.mbwarez.dk/d.com",
"http://cygwin.mbwarez.dk/d.com/cygwin/M",
"http://cygwin.mbwarez.dk/d.com/cygwin/a",
"http://cygwin.mbwarez.dk/d/cygwin/",
"http://cygwin.mbwarez.dk/de/cygwin/r.c",
"http://cygwin.mbwarez.dk/degwin/",
"http://cygwin.mbwarez.dk/e",
"http://cygwin.mbwarez.dk/e/cygwin/com/",
"http://cygwin.mbwarez.dk/ecygwin/Y7",
"http://cygwin.mbwarez.dk/edu.cn/)",
"http://cygwin.mbwarez.dk/en.denl",
"http://cygwin.mbwarez.dk/et/cygwin/7",
"http://cygwin.mbwarez.dk/et/cygwin/n/",
"http://cygwin.mbwarez.dk/et/cygwin/uniK/",
"http://cygwin.mbwarez.dk/etn/h%",
"http://cygwin.mbwarez.dk/etworks.org/r",
"http://cygwin.mbwarez.dk/eu.sg",
"http://cygwin.mbwarez.dk/fly.by/pub/",
"http://cygwin.mbwarez.dk/ftp.iij.",
"http://cygwin.mbwarez.dk/ftp://mi",
"http://cygwin.mbwarez.dk/gwin/",
"http://cygwin.mbwarez.dk/gwin/.net;2Y",
"http://cygwin.mbwarez.dk/gwin///",
"http://cygwin.mbwarez.dk/gwin///Un",
"http://cygwin.mbwarez.dk/gwin//rors.",
"http://cygwin.mbwarez.dk/gwin/2t",
"http://cygwin.mbwarez.dk/gwin/32/f",
"http://cygwin.mbwarez.dk/gwin/in/",
"http://cygwin.mbwarez.dk/gwin/in/c.o4",
"http://cygwin.mbwarez.dk/gwin/in/rali",
"http://cygwin.mbwarez.dk/gwin/win/",
"http://cygwin.mbwarez.dk/h.decnia",
"http://cygwin.mbwarez.dk/hu/pub/cygwin/y#",
"http://cygwin.mbwarez.dk/in.uib.no/2/",
"http://cygwin.mbwarez.dk/in/",
"http://cygwin.mbwarez.dk/in//",
"http://cygwin.mbwarez.dk/in/I",
"http://cygwin.mbwarez.dk/in/X)",
"http://cygwin.mbwarez.dk/in/gwin/&",
"http://cygwin.mbwarez.dk/in/in/",
"http://cygwin.mbwarez.dk/in/in/s:/",
"http://cygwin.mbwarez.dk/in/l.ca/",
"http://cygwin.mbwarez.dk/in/n//",
"http://cygwin.mbwarez.dk/in/o",
"http://cygwin.mbwarez.dk/in/tps://",
"http://cygwin.mbwarez.dk/in/win32/",
"http://cygwin.mbwarez.dk/in/ygwin/",
"http://cygwin.mbwarez.dk/in/ygwin/~5",
"http://cygwin.mbwarez.dk/irrors",
"http://cygwin.mbwarez.dk/ist.ac.jp/p",
"http://cygwin.mbwarez.dk/lgaria",
"http://cygwin.mbwarez.dk/m%",
"http://cygwin.mbwarez.dk/m&",
"http://cygwin.mbwarez.dk/m/cygwin//",
"http://cygwin.mbwarez.dk/m/cygwin/t/",
"http://cygwin.mbwarez.dk/main",
"http://cygwin.mbwarez.dk/mcygwin/",
"http://cygwin.mbwarez.dk/mirrorservice.",
"http://cygwin.mbwarez.dk/mygwin/",
"http://cygwin.mbwarez.dk/n",
"http://cygwin.mbwarez.dk/n.de",
"http://cygwin.mbwarez.dk/n.uib.noor",
"http://cygwin.mbwarez.dk/n/",
"http://cygwin.mbwarez.dk/n////",
"http://cygwin.mbwarez.dk/n//n32/",
"http://cygwin.mbwarez.dk/n/com/o/",
"http://cygwin.mbwarez.dk/n/cygwin/",
"http://cygwin.mbwarez.dk/n/e6",
"http://cygwin.mbwarez.dk/n/gwin/",
"http://cygwin.mbwarez.dk/n/l.ca/pub",
"http://cygwin.mbwarez.dk/n/n/E",
"http://cygwin.mbwarez.dk/net.fi/pub/mir",
"http://cygwin.mbwarez.dk/neta",
"http://cygwin.mbwarez.dk/neth/",
"http://cygwin.mbwarez.dk/no/cygwin/",
"http://cygwin.mbwarez.dk/ochum.dep/pub6",
"http://cygwin.mbwarez.dk/om/cygwin/",
"http://cygwin.mbwarez.dk/om/cygwin/~:",
"http://cygwin.mbwarez.dk/omC",
"http://cygwin.mbwarez.dk/omygwin/",
"http://cygwin.mbwarez.dk/oo.ca",
"http://cygwin.mbwarez.dk/or",
"http://cygwin.mbwarez.dk/orks.net",
"http://cygwin.mbwarez.dk/osl.orgorg",
"http://cygwin.mbwarez.dk/p",
"http://cygwin.mbwarez.dk/p-stud.hs-essl",
"http://cygwin.mbwarez.dk/ps.com/cygw",
"http://cygwin.mbwarez.dk/pub/cygwin/",
"http://cygwin.mbwarez.dk/pub/cygwin/ma",
"http://cygwin.mbwarez.dk/q/",
"http://cygwin.mbwarez.dk/rafal.ca/",
"http://cygwin.mbwarez.dk/rg",
"http://cygwin.mbwarez.dk/rg/cygwin/",
"http://cygwin.mbwarez.dk/rg/cygwin/.",
"http://cygwin.mbwarez.dk/rg/cygwin/H;",
"http://cygwin.mbwarez.dk/rmanymagata-u",
"http://cygwin.mbwarez.dk/ror.aarnet.edu",
"http://cygwin.mbwarez.dk/rors/c",
"http://cygwin.mbwarez.dk/rror.garr.iz",
"http://cygwin.mbwarez.dk/s/cygwin/m",
"http://cygwin.mbwarez.dk/s/cygwin/~",
"http://cygwin.mbwarez.dk/sd",
"http://cygwin.mbwarez.dk/t/cygwin/et1",
"http://cygwin.mbwarez.dk/t/cygwin/rau_",
"http://cygwin.mbwarez.dk/ta-u.ac.jpx;S",
"http://cygwin.mbwarez.dk/ter",
"http://cygwin.mbwarez.dk/tt.com//Mirr",
"http://cygwin.mbwarez.dk/uAsiaKon",
"http://cygwin.mbwarez.dk/uc.ptjp",
"http://cygwin.mbwarez.dk/uy.com/"
],
"id": "238",
"description": "URLs found in memory or binary data"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\R0IAZP7Z"
],
"id": "90",
"description": "Creates files inside the user directory"
},
{
"severity": "IMPACT_SEVERITY_INFO",
"match_data": [
"8.43.85.97:443 -> 192.168.2.13:49711 version: TLS 1.2"
],
"id": "7058",
"description": "Uses secure TLS version for HTTPS connections"
},
{
"id": "263",
"refs": [
{
"ref": "#memory_dumps",
"value": "software.exe, 00000000.00000002.4470709658.00000000000FD000.00000004.00000020.00020000.00000000.sdmp"
},
{
"ref": "#memory_dumps",
"value": "software.exe, 00000000.00000002.4471089039.0000000000163000.00000004.00000020.00020000.00000000.sdmp"
}
],
"match_data": [
"Hyper-V RAWp",
"Hyper-V RAW"
],
"description": "May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)",
"severity": "IMPACT_SEVERITY_INFO"
},
{
"id": "238",
"match_data": [
"ftp://cygwin.mirror.rafal.ca/pub/cygwin/ygwin",
"ftp://ftp-stud.hs-esslingen.de",
"ftp://ftp-stud.hs-esslingen.de/pub/Mirrors/sources.redhat.com/cygwin/https://.",
"ftp://ftp-stud.hs-esslingen.dehttp://m",
"ftp://ftp.byfly.by/pub/cygwin//",
"ftp://ftp.byfly.by/pub/cygwin/aren.net/Unix/sourceware.org/cygwin/rror.terrahost.nodek/",
"ftp://ftp.byfly.by/pub/cygwin/rs",
"ftp://ftp.eq.uc.pt",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://m",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/http://mG",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/https://",
"ftp://ftp.eq.uc.pt/pub/software/pc/prog/cygwin/https://O",
"ftp://ftp.fa",
"ftp://ftp.fau.de/cygwin//cygwin//http9",
"ftp://ftp.fau.de/cygwin/http://f",
"ftp://ftp.fau.de/cygwin/p",
"ftp://ftp.fsn.hu/pub/cygwin/",
"ftp://ftp.fsn.hu/pub/cygwin/in/",
"ftp://ftp.fsn.hu/pub/cygwin/n",
"ftp://ftp.fsn.hu/pub/cygwin/ygwin/http://m",
"ftp://ftp.fsn.hulhttp:",
"ftp://ftp.fsn.hurs",
"ftp://ftp.funet.fi",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/",
"ftp://ftp.funet.fi/pub/mirrors/sourceware.org/pub/cygwin/e",
"ftp://ftp.halifax.rwth-aachen.de/cygwin/dk/irror",
"ftp://ftp.halifax.rwth-aachen.der",
"ftp://ftp.iij.ad.jp/pub/cygwin/",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://m",
"ftp://ftp.iij.ad.jp/pub/cygwin/http://mp",
"ftp://ftp.iij.ad.jp/pub/cygwin/https://",
"ftp://ftp.iij.ad.jphttp",
"ftp://ftp.inf.tu-dresden.de",
"ftp://ftp.inf.tu-dresden.degor",
"ftp://ftp.inf.tu-dresden.derror",
"ftp://ftp.jaist.ac.jp/pub/cygwin/",
"ftp://ftp.jaist.ac.jp/pub/cygwin/http:/",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/http://m",
"ftp://ftp.kr.freebsd.org/pub/cygwin.com/cygwin/https://",
"ftp://ftp.kr.freebsd.orgermany",
"ftp://ftp.kr.freebsd.orghttps://",
"ftp://ftp.l",
"ftp://ftp.m/",
"ftp://ftp.mirrorservice.orghttps://ftp.",
"ftp://ftp.ntu.edu.tw/pub/cygwin/",
"ftp://ftp.ntu.edu.tw/pub/cygwin/https:/",
"ftp://ftp.ntua.gr/pub/pc/cygwin//http://m",
"ftp://ftp.ntua.gr/pub/pc/cygwin/p",
"ftp://ftp.ntua.gr/pub/pc/cygwin/s",
"ftp://ftp.rnl.tecnico.ulisboa.pt/pub/cygwin/irror",
"ftp://ftp.snt.utwente.nlgwin//",
"ftp://ftp.snt.utwente.nlp",
"ftp://ftp.twaren.net/Unix/sourceware.org/cygwin/in/koddos",
"ftp://ftp.yz.yamagata-u.ac.jp",
"ftp://ftp.yz.yamagata-u.ac.jp/p",
"ftp://ftp.yz.yamagata-u.ac.jp/pn",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/c",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/http:",
"ftp://ftp.yz.yamagata-u.ac.jp/pub/cygwin/https://",
"ftp://mirror.checkdomain.de/cygwin/",
"ftp://mirror.checkdomain.de/cygwin/cygwin",
"ftp://mirror.cs.vt.edu/pub/cygwin/cygwin//n/ite",
"ftp://mirror.datacenter.by",
"ftp://mirror.datacenter.by/pub/mirrors/cygwin/http://m",
"ftp://mirror.datacenter.byp",
"ftp://mirror.datacenter.bywin/http://m",
"ftp://mirror.easyname.at/cygwin/r",
"ftp://mirror.easyname.atch.den/http:/",
"ftp://mirror.i",
"ftp://mirror.internode.on.net/pub/cygwin/ygwin/r",
"ftp://mirror.lagoon.nc/cygwin/",
"ftp://mirror.lagoon.nc/cygwin/http://lii",
"ftp://mirror.lagoon.nc/cygwin/http://m",
"ftp://mirror.lagoon.nc/cygwin/p",
"ftp://mirror.lagoon.nc/cygwin/win",
"ftp://mirror.rise.ph/cygwin/cygwin/http/",
"ftp://mirror.rise.phwarez",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/http://f",
"ftp://mirrors.dotsrc.org/mirrors/cygwin/rror",
"ftp://mirrors.dotsrc.orgn.dehttp://f",
"ftp://mirrors.netix.net/cygwin/https://",
"ftp://mirrors.xmission.com/cygwin/tp",
"ftp://sourceware.org/ftp://sources.redhat.com/ftp://gcc.gnu.org/",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/http://s",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/https://",
"ftp://sunsite.icm.edu.pl/pub/cygnus/cygwin/https://J",
"ftp://sunsite.icm.edu.plp",
"http://apps.identrust.com/roots/dstrootcax3.p7c0",
"http://cps.letsencrypt.org0",
"http://cps.root-x1.letsencrypt.org0",
"http://crl.identrust.com/DSTROOTCAX3CRL.crl0",
"http://cygwin.cathedral-",
"http://cygwin.cathedral-networks.org",
"http://cygwin.cathedral-networks.org-",
"http://cygwin.cathedral-networks.org.org/cygwin/",
"http://cygwin.cathedral-networks.org/",
"http://cygwin.cathedral-networks.org/)",
"http://cygwin.cathedral-networks.org/-a",
"http://cygwin.cathedral-networks.org/.",
"http://cygwin.cathedral-networks.org/.d",
"http://cygwin.cathedral-networks.org/.e",
"http://cygwin.cathedral-networks.org/.md",
"http://cygwin.cathedral-networks.org/.n",
"http://cygwin.cathedral-networks.org/.o",
"http://cygwin.cathedral-networks.org/.oL",
"http://cygwin.cathedral-networks.org/.v",
"http://cygwin.cathedral-networks.org//",
"http://cygwin.cathedral-networks.org///",
"http://cygwin.cathedral-networks.org///1",
"http://cygwin.cathedral-networks.org///5",
"http://cygwin.cathedral-networks.org///=",
"http://cygwin.cathedral-networks.org///Q",
"http://cygwin.cathedral-networks.org///T",
"http://cygwin.cathedral-networks.org///Z",
"http://cygwin.cathedral-networks.org//1",
"http://cygwin.cathedral-networks.org//2",
"http://cygwin.cathedral-networks.org//L",
"http://cygwin.cathedral-networks.org//d",
"http://cygwin.cathedral-networks.org//f",
"http://cygwin.cathedral-networks.org//f/",
"http://cygwin.cathedral-networks.org//l",
"http://cygwin.cathedral-networks.org//m",
"http://cygwin.cathedral-networks.org//mW",
"http://cygwin.cathedral-networks.org//sg",
"http://cygwin.cathedral-networks.org//w",
"http://cygwin.cathedral-networks.org/9",
"http://cygwin.cathedral-networks.org/;cygwin.cathedral-networks.org;Europe;Norway;noshow",
"http://cygwin.cathedral-networks.org/=",
"http://cygwin.cathedral-networks.org/B",
"http://cygwin.cathedral-networks.org/M",
"http://cygwin.cathedral-networks.org/P",
"http://cygwin.cathedral-networks.org/R",
"http://cygwin.cathedral-networks.org/S",
"http://cygwin.cathedral-networks.org/U",
"http://cygwin.cathedral-networks.org/Un",
"http://cygwin.cathedral-networks.org/V",
"http://cygwin.cathedral-networks.org/Z",
"http://cygwin.cathedral-networks.org/al",
"http://cygwin.cathedral-networks.org/ar",
"http://cygwin.cathedral-networks.org/au",
"http://cygwin.cathedral-networks.org/cj",
"http://cygwin.cathedral-networks.org/cy",
"http://cygwin.cathedral-networks.org/d",
"http://cygwin.cathedral-networks.org/de",
"http://cygwin.cathedral-networks.org/doF",
"http://cygwin.cathedral-networks.org/e",
"http://cygwin.cathedral-networks.org/ed",
"http://cygwin.cathedral-networks.org/fs",
"http://cygwin.cathedral-networks.org/ft",
"http://cygwin.cathedral-networks.org/ftI",
"http://cygwin.cathedral-networks.org/ftW",
"http://cygwin.cathedral-networks.org/g",
"http://cygwin.cathedral-networks.org/in",
"http://cygwin.cathedral-networks.org/it",
"http://cygwin.cathedral-networks.org/la",
"http://cygwin.cathedral-networks.org/li",
"http://cygwin.cathedral-networks.org/lo",
"http://cygwin.cathedral-networks.org/m",
"http://cygwin.cathedral-networks.org/m-",
"http://cygwin.cathedral-networks.org/n",
"http://cygwin.cathedral-networks.org/n/",
"http://cygwin.cathedral-networks.org/p",
"http://cygwin.cathedral-networks.org/pT",
"http://cygwin.cathedral-networks.org/ps",
"http://cygwin.cathedral-networks.org/r.",
"http://cygwin.cathedral-networks.org/ra",
"http://cygwin.cathedral-networks.org/s.",
"http://cygwin.cathedral-networks.org/t",
"http://cygwin.cathedral-networks.org/tp",
"http://cygwin.cathedral-networks.org/tp#1",
"http://cygwin.cathedral-networks.org/ts",
"http://cygwin.cathedral-networks.org/u",
"http://cygwin.cathedral-networks.org/u.",
"http://cygwin.cathedral-networks.org/ub",
"http://cygwin.cathedral-networks.org/v",
"http://cygwin.cathedral-networks.org/w",
"http://cygwin.cathedral-networks.org2",
"http://cygwin.cathedral-networks.org4",
"http://cygwin.cathedral-networks.org://",
"http://cygwin.cathedral-networks.orgC",
"http://cygwin.cathedral-networks.orgD",
"http://cygwin.cathedral-networks.orgR",
"http://cygwin.cathedral-networks.orgali",
"http://cygwin.cathedral-networks.orgata",
"http://cygwin.cathedral-networks.orgb",
"http://cygwin.cathedral-networks.orgb/m",
"http://cygwin.cathedral-networks.orgc",
"http://cygwin.cathedral-networks.orgc.%",
"http://cygwin.cathedral-networks.orgedH",
"http://cygwin.cathedral-networks.orgfr4",
"http://cygwin.cathedral-networks.orggad",
"http://cygwin.cathedral-networks.orght",
"http://cygwin.cathedral-networks.orghtt",
"http://cygwin.cathedral-networks.orghtt:",
"http://cygwin.cathedral-networks.orgi",
"http://cygwin.cathedral-networks.orgjp",
"http://cygwin.cathedral-networks.orgmir-",
"http://cygwin.cathedral-networks.orgn/",
"http://cygwin.cathedral-networks.orgn/9",
"http://cygwin.cathedral-networks.orgor",
"http://cygwin.cathedral-networks.orgran",
"http://cygwin.cathedral-networks.orgrr",
"http://cygwin.cathedral-networks.orgs/cx",
"http://cygwin.cathedral-networks.orgtac",
"http://cygwin.cathedral-networks.orgtud",
"http://cygwin.cathedral-networks.orguts6",
"http://cygwin.cathedral-networks.orgwina",
"http://cygwin.mbwarez",
"http://cygwin.mbwarez%",
"http://cygwin.mbwarez%%qc",
"http://cygwin.mbwarez.dk",
"http://cygwin.mbwarez.dk-bochum.deg/a",
"http://cygwin.mbwarez.dk.ac.jp/",
"http://cygwin.mbwarez.dk.at/cygwin/a",
"http://cygwin.mbwarez.dk.au",
"http://cygwin.mbwarez.dk.aun/lub",
"http://cygwin.mbwarez.dk.byygw",
"http://cygwin.mbwarez.dk.byygwin/://m",
"http://cygwin.mbwarez.dk.de/cygwin/",
"http://cygwin.mbwarez.dk.de/cygwin/N",
"http://cygwin.mbwarez.dk.org/o.net/c",
"http://cygwin.mbwarez.dk.orgP4",
"http://cygwin.mbwarez.dk.orgcygwin/w",
"http://cygwin.mbwarez.dk/",
"http://cygwin.mbwarez.dk/)ci",
"http://cygwin.mbwarez.dk/)cn",
"http://cygwin.mbwarez.dk/.ac.nz",
"http://cygwin.mbwarez.dk/.ad.jp7",
"http://cygwin.mbwarez.dk/.cn/cygwin/-hB",
"http://cygwin.mbwarez.dk/.de",
"http://cygwin.mbwarez.dk/.de/ub/cygwi",
"http://cygwin.mbwarez.dk/.degwin/",
"http://cygwin.mbwarez.dk/.detp.snt.0",
"http://cygwin.mbwarez.dk/.jpin/",
"http://cygwin.mbwarez.dk/.kr.free=",
"http://cygwin.mbwarez.dk//",
"http://cygwin.mbwarez.dk////",
"http://cygwin.mbwarez.dk///cygwin/",
"http://cygwin.mbwarez.dk///cygwin/X",
"http://cygwin.mbwarez.dk///ftp.yz.ya",
"http://cygwin.mbwarez.dk///in/n/",
"http://cygwin.mbwarez.dk///ygwin/W",
"http://cygwin.mbwarez.dk//al.ca/L",
"http://cygwin.mbwarez.dk//cygwin.viem-i0",
"http://cygwin.mbwarez.dk//cygwin/",
"http://cygwin.mbwarez.dk//cygwin//",
"http://cygwin.mbwarez.dk//cygwin///W",
"http://cygwin.mbwarez.dk//cygwin//H",
"http://cygwin.mbwarez.dk//cygwin/E",
"http://cygwin.mbwarez.dk//cygwin/m",
"http://cygwin.mbwarez.dk//cygwin/o/",
"http://cygwin.mbwarez.dk//cygwin32/",
"http://cygwin.mbwarez.dk//gwin/",
"http://cygwin.mbwarez.dk//in/",
"http://cygwin.mbwarez.dk//in//n/4",
"http://cygwin.mbwarez.dk//in/n//",
"http://cygwin.mbwarez.dk//mirro",
"http://cygwin.mbwarez.dk//mirror-hk.",
"http://cygwin.mbwarez.dk//n//",
"http://cygwin.mbwarez.dk//n//in/",