Edit tour

Windows Analysis Report
https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe

Overview

General Information

Sample URL:	https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe
Analysis ID:	1559301
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Drops large PE files

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Binary contains a suspicious time stamp

Drops PE files

Found dropped PE file which has not been started or loaded

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Usage Of Web Request Commands And Cmdlets

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6720 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wget.exe (PID: 3844 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

UltiMaker-Cura-5.9.0-win64-X64.exe (PID: 5864 cmdline: "C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe" MD5: E867C2A9D4708BC6FD4AD11A9A09A9DF)

cleanup

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5800, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" > cmdline.out 2>&1, ProcessId: 6720, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5800, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" > cmdline.out 2>&1, ProcessId: 6720, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe

Window detected: < &BackI &AgreeCancelUltiMaker Cura 5.9.0 UltiMaker Cura 5.9.0License AgreementPlease review the license terms before installing UltiMaker Cura 5.9.0.Press Page Down to see the rest of the agreement. GNU LESSER GENERAL PUBLIC LICENSE Version 3 29 June 2007 Copyright (C) 2007 Free Software Foundation Inc. <http://fsf.org/> Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed. This version of the GNU Lesser General Public License incorporatesthe terms and conditions of version 3 of the GNU General PublicLicense supplemented by the additional permissions listed below. 0. Additional Definitions. As used herein "this License" refers to version 3 of the GNU LesserGeneral Public License and the "GNU GPL" refers to version 3 of the GNUGeneral Public License. "The Library" refers to a covered work governed by this Licenseother than an Application or a Combined Work as defined below. An "Application" is any work that makes use of an interface providedby the Library but which is not otherwise based on the Library.Defining a subclass of a class defined by the Library is deemed a modeof using an interface provided by the Library. A "Combined Work" is a work produced by combining or linking anApplication with the Library. The particular version of the Librarywith which the Combined Work was made is also called the "LinkedVersion". The "Minimal Corresponding Source" for a Combined Work means theCorresponding Source for the Combined Work excluding any source codefor portions of the Combined Work that considered in isolation arebased on the Application and not on the Linked Version. The "Corresponding Application Code" for a Combined Work means theobject code and/or source code for the Application including any dataand utility programs needed for reproducing the Combined Work from theApplication but excluding the System Libraries of the Combined Work. 1. Exception to Section 3 of the GNU GPL. You may convey a covered work under sections 3 and 4 of this Licensewithout being bound by section 3 of the GNU GPL. 2. Conveying Modified Versions. If you modify a copy of the Library and in your modifications afacility refers to a function or data to be supplied by an Applicationthat uses the facility (other than as an argument passed when thefacility is invoked) then you may convey a copy of the modifiedversion: a) under this License provided that you make a good faith effort to ensure that in the event an Application does not supply the function or data the facility still operates and performs whatever part of its purpose remains meaningful or b) under the GNU GPL with none of the additional permissions of this License applicable to that copy. 3. Object Code Incorporating Material from Library Header Files. The object code form of an Application may incorporate material froma header file that is part of the Library. You may convey such objectcode under ter

Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_lzma.pdbNN source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4006281137.00000000049C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041897069.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_decimal.pdb$$ source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.3999764946.00000000049A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4020470189.00000000049A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4040928076.00000000049A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_ssl.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4017944320.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_multiprocessing.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4010125159.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\concrt140.amd64.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4051854346.00000000049A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4024167700.00000000049A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4038467797.00000000049AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4040237695.00000000049AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_asyncio.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.3996315017.00000000049A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4021043547.00000000049A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: O:\promo\20210804\tmp\win_32e-rtl_int_5_nor_dyn.rel.c0.s0.t1..h1.w1-anompbdwwin02\libiomp5md.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135092895.00000000049A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028588656.00000000049A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qt3d_build\plugins\sceneparsers\gltfsceneimport.pdb!!! source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4093721564.00000000049AB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_lzma.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4006281137.00000000049C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4021690285.00000000049AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qt3d_build\plugins\geometryloaders\gltfgeometryloader.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4088203857.00000000049A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4039646076.00000000049A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbHc source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4070952484.00000000049AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_elementtree.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4000818506.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: signaturevalidityissuerUIDsubjectUIDextensionsX509_CINFcert_infosig_algcrypto\x509\x_x509.cunknown librarysystem librarybignum routinesrsa routinesDiffie-Hellman routinesdigital envelope routinesmemory buffer routinesobject identifier routinesPEM routinesdsa routinesx509 certificate routinesasn1 encoding routinesconfiguration file routinescommon libcrypto routineselliptic curve routinesECDSA routinesECDH routinesSSL routinesBIO routinesPKCS7 routinesX509 V3 routinesPKCS12 routinesrandom number generatorDSO support routinestime stamp routinesengine routinesOCSP routinesUI routinesFIPS routinesCMS routinesCRMF routinesCMP routinesHMAC routinesCT routinesASYNC routinesKDF routinesSTORE routinesSM2 routinesESS routinesProvider routinesENCODER routinesDECODER routinesHTTP routinessystem libBN libRSA libDH libEVP libBUF libOBJ libPEM libDSA libX509 libASN1 libCRYPTO libEC libBIO libPKCS7 libX509V3 libENGINE libUI libECDSA libOSSL_STORE libOSSL_DECODER libfatalmalloc failurecalled a function you should not callpassed a null parametercalled a function that was disabled at compile-timeinit failpassed invalid argumentoperation failinvalid provider functionsinterrupted or cancellednested asn1 errormissing asn1 eosunsupportedfetch failedinvalid property definitionunable to get read lockunable to get write lockC:\.conan\65bd90\1\src\crypto\err\err_local.hcrypto\err\err.clib(%lu)reason(%lu)error:%08lX:%s:%s:%serr:%lx:%lx:%lx:%lx<NULL>pollingcrypto\rand\rand_lib.cRAND_priv_bytes_exRAND_bytes_exrand_new_seedSEED-SRCCTR-DRBGrand_new_drbgmacuse_derivation_functionreseed_requestsreseed_time_intervalRAND_get0_primaryrandom_conf_initrandomseed_propertiesname=%s, value=%sC:\.conan\b678a4\1\resC:\.conan\b678a4\1\res/certsC:\.conan\b678a4\1\res/cert.pemSSL_CERT_DIRSSL_CERT_FILEcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"ZLIB" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" -D"NDEBUG" -I"C:/.conan/ffeb41/1/include" -DNDEBUGOpenSSL 3.2.0 23 Nov 20233.2.0built on: Mon Aug 26 12:00:47 2024 UTCplatform: VC-conan-Release-Windows-x86_64-Visual Studio-17OPENSSLDIR: "C:\.conan\b678a4\1\res"ENGINESDIR: "\lib\engines-3"MODULESDIR: "\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\x509\x_all.cX509_CRL_digest source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4017944320.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtdeclarative_build\qml\QtQuick\Effects\effectsplugin.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4073282014.00000000049A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qt3d_build\plugins\geometryloaders\gltfgeometryloader.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4088203857.00000000049A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046163424.00000000049A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: libmmd.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4141985720.00000000049A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_decimal.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.3999764946.00000000049A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\20d62d\1\build\RelWithDebInfo\Arcus.pdbUU& source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4049294380.0000000004BD4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4033187886.00000000049AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qt3d_build\plugins\geometryloaders\defaultgeometryloader.pdb$$$ source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4072644318.00000000049AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_uuid.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4018775898.00000000049AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_overlapped.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4011316775.00000000049A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qt3d_build\plugins\sceneparsers\gltfsceneimport.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4093721564.00000000049AB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4039042490.00000000049A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtremoteobjects_build\qml\QtRemoteObjects\declarative_remoteobjectsplugin.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4071876673.00000000049A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026255543.00000000049A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"ZLIB" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" -D"NDEBUG" -I"C:/.conan/ffeb41/1/include" -DNDEBUG source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4017944320.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_hashlib.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4004152012.00000000049A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4027429470.00000000049A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.8.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_sqlite3.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4014338592.00000000049A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_bz2.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.3997014981.00000000049AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4070952484.00000000049AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4035417313.00000000049A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtmultimedia_build\plugins\multimedia\ffmpegmediaplugin.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.000000000502D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4031475214.00000000049A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\20d62d\1\build\RelWithDebInfo\Arcus.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4049294380.0000000004BD4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043696511.00000000049A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtmultimedia_build\plugins\multimedia\ffmpegmediaplugin.pdbr source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.000000000502D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qt3d_build\plugins\sceneparsers\gltfsceneexport.pdb!!! source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4090634160.00000000049AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_queue.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4012019914.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_socket.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4012815121.00000000049AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qt3d_build\plugins\geometryloaders\defaultgeometryloader.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4072644318.00000000049AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\9105f6\1\build\RelWithDebInfo\CuraEngine.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000005071000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_ctypes.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.3999172371.00000000049A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_msi.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4007098729.00000000049A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qt3d_build\plugins\sceneparsers\gltfsceneexport.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4090634160.00000000049AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\.conan\31d95e\1\source_subfolder\PCbuild\amd64\_ssl.pdba source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4017944320.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: providerfipsparse_namecrypto\property\property_parse.cHERE-->%sparse_numberparse_hexparse_octparse_stringHERE-->%c%sparse_unquotedstack_to_property_listDuplicated name `%s'ossl_parse_propertyUnknown name HERE-->%s!=ossl_parse_queryno%lldcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"ZLIB" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" -D"NDEBUG" -I"C:/.conan/ffeb41/1/include" -DNDEBUG;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific\lib\engines-3\lib\ossl-modules.dllCPUINFO: algorithm-idcrypto\asn1\a_verify.cASN1_item_verify_ctxnid=0x%xcrypto\asn1\a_d2i_fp.casn1_d2i_read_biocrypto\asn1\a_i2d_fp.cASN1_item_i2d_bio source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4017944320.00000000049A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: libbanded5x.Q3V52YHHGVBP5BKVHJ5RHQVFWHHSLVWO.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libdcsrch.P5Z6327L4J4YX7VMZCE3MTP6NS6Y27NL.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 18 > 10
Source: libslsqp_op.DWGQCCHJGSVIEWNAXXJNX5QEBXDLEZ6S.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libspecfun.EQQHSAL4UXRMFPQKIKWYZZHURLBGCOUA.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libdfft.WRTMMEH5UV6SVZGVJJR2BISM4UAAFUHK.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libdqag.JS5HK6GJYPYAVHXSU4IED7E6EDNXJPES.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libdgamln.Z6BKGG6AQLKLECRJKJZPOW6EJ3ZGLBSM.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libwrap_dum.VCPJVPXA4TMVD6JKTVKDGTAWZTJZP4HP.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 18 > 10
Source: libnnls.66WCOTEDAJSJGYAEDTDWRE2ESXAXBKEN.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: lib_test_fo.QPCHJG62YODVNLXFORXFSYVCEWUTQYBE.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: lib_arpack-.PCSDVX3OS5X6BRVZHYRV46LDN2LN6SH6.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: lib_blas_su.QHARUV3FD7SFILAGY64NT4SGS5C43TUE.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 18 > 10
Source: libdfitpack.2M7QQYHLVWVUZSM3RNOWJEKNE7NZJV5I.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libd_odr.CLPWYAWYDTZQTV5NKHWX4MRM3LCNL5BL.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: mkl_mc.1.dll.8.dr	Static PE information: Number of sections : 11 > 10
Source: lib_spropac.OU2GHQDTD5ETHJLP6TNQESQTYA3IQ3FF.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libopenblas.PZA5WNOTOH6FZLB2KBVKAURAKVTFSNNU.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: lib_lsoda-f.BRIKWXGY5O3DFO3FAOO7RZX266LZZJJU.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libdet.MQ7TLNX5EA6FMON4WJPFHYJABR4BMPX2.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: lib_vode-f2.J56WIK7TJAWSI2VBBACIFAL5OGCP6QHV.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: liblbfgsb.EVWBKZ3IYWHNVBPGLUELZFSPKK6Z5JEQ.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: mkl_avx512.1.dll.8.dr	Static PE information: Number of sections : 11 > 10
Source: mkl_avx.1.dll.8.dr	Static PE information: Number of sections : 11 > 10
Source: libansari.HQJLJ7GFMGJGI5BMKQFGBLY7Q4ARHZLN.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: mkl_avx2.1.dll.8.dr	Static PE information: Number of sections : 11 > 10
Source: lib_zpropac.7Z7FXXRPUBCDM5VRA7TWVJ4QG6ALQW2P.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libiomp5md.dll.8.dr	Static PE information: Number of sections : 11 > 10
Source: libwrap_dum.65QGNY7GDSLXRT5XKUAXSGWGUGJN6JNT.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 18 > 10
Source: libcobyla2.XFABYWDJC4LOJ6PJZGQRN3CMAPOHQIIJ.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: mkl_def.1.dll.8.dr	Static PE information: Number of sections : 11 > 10
Source: libblkdta00.ZNRYAYDPCCAJ57FXKMCV3QTAMNVEIG34.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libchkder.IRHGQSNQFDFQX6QVQ7RPHOAAXVUKO7EW.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libmvndst.F2B2SMFSEZIJFVRPXAOHJYR3NGIRP6A4.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libopenblas.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libbispeu.UN63X2NX4VOAFHGY5IGTP4WNGFREASOW.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libgetbreak.M7HGAULNOMJJOBD4QLMOXHAHWFEUROJS.gfortran-win_amd64.dll.8.dr	Static PE information: Number of sections : 19 > 10

Source: api-ms-win-core-heap-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: libimalloc.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.8.dr	Static PE information: No import functions for PE file found

Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4014338592.00000000049A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4014338592.00000000049A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4014338592.00000000049A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe"
Source: unknown	Process created: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe "C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Automated click: I Agree
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	Automated click: Install

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	File Volume queried: C:\Program Files FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe	File Volume queried: C:\Program Files FullSizeInformation			Jump to behavior

Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4072644318.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4093721564.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.000000000502D000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4071876673.00000000049A6000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4073282014.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4090634160.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4088203857.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.entrust.net/evcs2-chain.p7c01
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4072644318.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4093721564.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.000000000502D000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4071876673.00000000049A6000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4073282014.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4090634160.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4088203857.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135092895.0000000004B21000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135746842.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4137010580.0000000004A39000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4141985720.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4132534939.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4131556440.00000000049A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135092895.0000000004B21000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135746842.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4137010580.0000000004A39000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4141985720.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4132534939.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4131556440.00000000049A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4072644318.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4093721564.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.000000000502D000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4071876673.00000000049A6000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4073282014.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4090634160.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4088203857.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4072644318.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4093721564.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.000000000502D000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4071876673.00000000049A6000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4073282014.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4090634160.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4088203857.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4072644318.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4093721564.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.000000000502D000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4071876673.00000000049A6000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4073282014.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4090634160.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4088203857.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/evcs2.crl0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4072644318.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4093721564.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.000000000502D000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4071876673.00000000049A6000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4073282014.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4090634160.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4088203857.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4072644318.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4093721564.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.000000000502D000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4071876673.00000000049A6000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4073282014.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4090634160.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4088203857.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: wget.exe, 00000002.00000003.3755877718.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.3755877718.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: wget.exe, 00000002.00000003.3755877718.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.3755877718.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: wget.exe, 00000002.00000003.3755877718.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.3817680135.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.3818263701.0000000002AD2000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.3755877718.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4220334695.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4301734670.00000000049A4000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4310721434.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4306161981.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4249690279.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4302192509.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4299527484.000000000500A000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4304049200.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4302937260.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4312332818.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4310056855.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4133110434.00000000049A2000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4311484137.00000000049A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA2.crl0t
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4220334695.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135092895.0000000004B21000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4301734670.00000000049A4000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4310721434.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4306161981.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4249690279.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4302192509.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135746842.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4299527484.000000000500A000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4304049200.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4137010580.0000000004A39000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4302937260.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4312332818.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4310056855.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4133110434.00000000049A2000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4311484137.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4141985720.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4132534939.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4131556440.00000000049A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: wget.exe, 00000002.00000003.3755877718.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.3755877718.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: wget.exe, 00000002.00000003.3755877718.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.3755877718.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: wget.exe, 00000002.00000003.3755877718.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.3817680135.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.3818263701.0000000002AD2000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.3755877718.0000000002ACE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4220334695.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4301734670.00000000049A4000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4310721434.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4306161981.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4249690279.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4302192509.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4299527484.000000000500A000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4304049200.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4302937260.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4312332818.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4310056855.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4133110434.00000000049A2000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4311484137.00000000049A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4220334695.0000000004B31000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135092895.0000000004B21000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4301734670.00000000049A4000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4310721434.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4306161981.00000000049AA000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4249690279.00000000049AD000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4302192509.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135746842.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4299527484.000000000500A000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4304049200.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4137010580.0000000004A39000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4302937260.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4312332818.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4310056855.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4133110434.00000000049A2000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4311484137.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4141985720.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4132534939.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4131556440.00000000049A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.00000000049A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dashif.org/guidelines/trickmode
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.3872026485.00000000049AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fsf.org/
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000000.3858447457.000000000040A000.00000008.00000001.01000000.00000004.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135092895.0000000004B21000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135746842.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4137010580.0000000004A39000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4066959570.0000000004B3C000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4141985720.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4132534939.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4131556440.00000000049A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135092895.0000000004B21000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4135746842.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4137010580.0000000004A39000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4141985720.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4132534939.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4131556440.00000000049A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0$
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023007508.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4043112536.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030736153.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4028017385.00000000049AF000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4029315477.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045751106.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025738116.00000000049A1000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4030086097.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4044074190.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4045080836.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019329638.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4046796926.00000000049A3000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4022377270.00000000049A7000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4032154988.00000000049A5000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4023599034.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4019896810.00000000049AE000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4041292418.00000000049A0000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4026845235.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4025102265.00000000049AC000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4034019541.00000000049A9000.00000004.00000020.00020000.00000000.sdmp, UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4042499015.00000000049A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C

Source: wget.exe, 00000002.00000002.3818052057.0000000000A08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: UltiMaker-Cura-5.9.0-win64-X64.exe, 00000008.00000003.4086315609.00000000049A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Screen Codec / VMware Video

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Source	Detection	Scanner
C:\Program Files\UltiMaker Cura 5.9.0\Arcus.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\CuraEngine.exe	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_asyncio.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_bz2.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_cffi_backend.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_ctypes.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_decimal.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_elementtree.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_hashlib.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_lzma.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_msi.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_multiprocessing.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_overlapped.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_queue.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_socket.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_sqlite3.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_ssl.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\_uuid.pyd	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\concrt140.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\d3dcompiler_47.dll	3%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\declarative_remoteobjectsplugin.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\defaultgeometryloader.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\effectsplugin.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\ffmpegmediaplugin.dll	4%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\gltfgeometryloader.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\gltfsceneexport.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\gltfsceneimport.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_arpack-.PCSDVX3OS5X6BRVZHYRV46LDN2LN6SH6.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_blas_su.QHARUV3FD7SFILAGY64NT4SGS5C43TUE.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_cpropac.BD3N3KOTIYDYD4F5BLDWUPIRGHES4COI.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_dop-f2p.R6OO3565SZTRZD5KAKQTXLRLCOY3ISHM.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_dpropac.57UVQFJYHBEKXRV4PFGDYU4YMRBGVPQG.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_lsoda-f.BRIKWXGY5O3DFO3FAOO7RZX266LZZJJU.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_spropac.OU2GHQDTD5ETHJLP6TNQESQTYA3IQ3FF.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_test_fo.QPCHJG62YODVNLXFORXFSYVCEWUTQYBE.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_vode-f2.J56WIK7TJAWSI2VBBACIFAL5OGCP6QHV.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\lib_zpropac.7Z7FXXRPUBCDM5VRA7TWVJ4QG6ALQW2P.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\libansari.HQJLJ7GFMGJGI5BMKQFGBLY7Q4ARHZLN.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\libbanded5x.Q3V52YHHGVBP5BKVHJ5RHQVFWHHSLVWO.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\libbispeu.UN63X2NX4VOAFHGY5IGTP4WNGFREASOW.gfortran-win_amd64.dll	0%	ReversingLabs
C:\Program Files\UltiMaker Cura 5.9.0\libblkdta00.ZNRYAYDPCCAJ57FXKMCV3QTAMNVEIG34.gfortran-win_amd64.dll	0%	ReversingLabs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
140.82.121.4	unknown	United States		36459	GITHUBUS	false
185.199.111.133	unknown	Netherlands		54113	FASTLYUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559301
Start date and time:	2024-11-20 12:07:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	urldownload.jbs
Sample URL:	https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.win@5/129@0/2

Process:	C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3000320
Entropy (8bit):	5.748540230424858
Encrypted:	false
SSDEEP:	49152:xOGxFGe0EbXI0P/KbX2uJFennv/V8YYZlZLXvndZSZniG7I951:hyeXVUBXv6
MD5:	EEAD90B11E45C4FDB75D9C35A4CBA048
SHA1:	5D3B32308807299088F9B6B7A5F04FD0455AC32D
SHA-256:	FE1D816969C064492DB5FE36C2AFBD3AB8C4722608B32E57E3C60FD180E1FA73
SHA-512:	F2F6F28B4B0E698CA3D9543A77B1C134D1D70FDB7CB2C0EDF447AE774464A00248DA9E49C2B272E8DA3248A6FB1C09A8AA0AEDF749B9FC9013F8DFD132963236
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............o.S.o.S.o.S...S.o.S..{R.o.S..\|R.o.S..zR.o.S..~R.o.S.o~S.o.S..~R.o.S..zR.o.S...R.o.S..S.o.S..}R.o.SRich.o.S................PE..d......f.........." ...&..".........F........................................@............`.........................................@5(.k.....-.......-.Y.....+................p....;$.8................... F$.(....:$.@.............-..............................text....."......."................. ..`.rdata...(....#..*....".............@..@.data....V...@+..L...$+.............@....pdata........+......p+.............@..@.idata...A....-..B...H-.............@..@.tls....+.....-.......-.............@....00cfg..u.....-.......-.............@..@.rsrc...Y.....-.......-.............@..@.reloc..H0.......2....-.............@..B........................................................................................................................

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (555), with CRLF line terminators
Category:	dropped
Size (bytes):	467725
Entropy (8bit):	2.2812679840571564
Encrypted:	false
SSDEEP:	1536:0qu7U0/OZYJD86a42iEdxzsr+evOSIYV8mfNOMbO6Q5AtavP2llvuqAzIBxoVDos:0qur9DxfemWEtrQr3X
MD5:	E57683D47BB64F054EBC20931A504F01
SHA1:	9DC194972A9F49A9ED79615313FC8AFED5EEE7DF
SHA-256:	030713DEA85B811ED1CC2B500395292C51D70F711EAE3453970A7497F542B801
SHA-512:	AD94471540C05BAC537CADF7D64D834D367509D6F4C2C0C48CA13C38F7048D09EE007F1D6B523D5505C5A54F30233A8BBD2B1484ADD90F48A306621E516C7033
Malicious:	false
Reputation:	low
Preview:	--2024-11-20 06:08:01-- https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe..Resolving github.com (github.com)... 140.82.121.4..Connecting to github.com (github.com)\|140.82.121.4\|:443... connected...HTTP request sent, awaiting response... 302 Found..Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/20884782/ffab5538-b308-43cc-a7a2-c4259a676b3c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241120%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241120T110802Z&X-Amz-Expires=300&X-Amz-Signature=58776495c50214acac5cb4a6b55f4a902eede56a8d33b7aa1402c56247b954e9&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DUltiMaker-Cura-5.9.0-win64-X64.exe&response-content-type=application%2Foctet-stream [following]..--2024-11-20 06:08:02-- https://objects.githubusercontent.com/github-production-release-asset-2e65be/20884782/ffab5538-b308-43cc-a7a2-c4259a676b3c?X-Amz-

Process:	C:\Windows\SysWOW64\wget.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	modified
Size (bytes):	302311768
Entropy (8bit):	7.999965614539531
Encrypted:	true
SSDEEP:	6291456:H+TZBRBShO+c2Z5QMw1hLNu/si7PU6MSDi/dJLhyO40kZjuR0d:edBSIEqZw/si7PU6RYGqRU
MD5:	E867C2A9D4708BC6FD4AD11A9A09A9DF
SHA1:	1606BB280BD5D0310FC7685EB1ACAC2B39093890
SHA-256:	2C78D8B50A32F66BF0075C6CAE1B1AA79B7384A1F542C49ECB70FF2AE296E581
SHA-512:	6383E0682A80ABE0700940C47942E4489EE55AAB9D0853E0337AA3AF77C15263E790042F1C623CAFE7838CDF353A9E16D08C976448C777D7034890F6734B4FEE
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L...c.d.................f...".......4............@.......................................@..........................................`..................P............................................................................................text...Ve.......f.................. ..`.rdata..X............j..............@..@.data...8............~..............@....ndata...................................rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................

Target ID:	0
Start time:	06:08:00
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe" > cmdline.out 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	06:08:01
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\UltiMaker Cura 5.9.0\Arcus.dll

C:\Program Files\UltiMaker Cura 5.9.0\CuraEngine.exe

C:\Program Files\UltiMaker Cura 5.9.0\_asyncio.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_bz2.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_cffi_backend.cp310-win_amd64.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_ctypes.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_decimal.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_elementtree.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_hashlib.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_lzma.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_msi.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_multiprocessing.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_overlapped.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_queue.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_socket.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_sqlite3.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_ssl.pyd

C:\Program Files\UltiMaker Cura 5.9.0\_uuid.pyd

C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-console-l1-1-0.dll

C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-datetime-l1-1-0.dll

C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-debug-l1-1-0.dll

C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Program Files\UltiMaker Cura 5.9.0\api-ms-win-core-file-l1-1-0.dll

Windows Analysis Report
https://github.com/Ultimaker/Cura/releases/download/5.9.0/UltiMaker-Cura-5.9.0-win64-X64.exe

Target ID:	8
Start time:	06:11:35
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\download\UltiMaker-Cura-5.9.0-win64-X64.exe"
Imagebase:	0x400000
File size:	302'311'768 bytes
MD5 hash:	E867C2A9D4708BC6FD4AD11A9A09A9DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre