24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/RustyEtiquette.A trojan Sample 09ef7c736bcc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 09ef7c736bcc…. Malware family: Win64/RustyEtiquette.A trojan. Threat score 100/100. 11/24 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","keywords":["Malicious","Win64/RustyEtiquette.A trojan","malware analysis","sandbox report","threat intelligence","09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff"],"about":{"@type":"SoftwareApplication","name":"SLC.DLL","applicationCategory":["pedll","64bits","executable"],"identifier":"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/RustyEtiquette.A trojan","antivirusDetections":{"malicious":11,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta2a,Found string "requires a dictionarydeflate decompression error" (Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "deflate decompression error:" (Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\async-compression-0.4.32\src\tokio\bufread\generic\decoder.rs" (Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\compression-core-0.4.29\src\util.rs" (Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\compression-codecs-0.4.31\src\gzip\header.rs" (Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "requires a dictionarydeflate decompression error" (Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "deflate decompression error:" (Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\async-compression-0.4.32\src\tokio\bufread\generic\decoder.rs" (Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\compression-core-0.4.29\src\util.rs" (Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\compression-codecs-0.4.31\src\gzip\header.rs" (Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "requires a dictionarydeflate decompression error" (Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found string "deflate decompression error:" (Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\async-compression-0.4.32\src\tokio\bufread\generic\decoder.rs" (Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\compression-core-0.4.29\src\util.rs" (Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\compression-codecs-0.4.31\src\gzip\header.rs" (Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp")26:T944,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "VirtualFree failed:" (Indicator: "VirtualFree"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "VirtualFree failed:" (Indicator: "VirtualFree"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "VirtualFree failed:" (Indicator: "VirtualFree"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "VirtualFree failed:" (Indicator: "VirtualFree"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")27:T11d4,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp")28:T9de,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")29:Tab4,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp")2a:T1072,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertDuplicateCertificateChain" (Indicator: "CertDuplicateCertificateChain"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertDuplicateStore" (Indicator: "CertDuplicateStore"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertDuplicateStore" (Indicator: "CertDuplicateStore"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertDuplicateCertificateChain" (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001304.00000000.286258.FC080000.00000004.mdmp")2b:T199d,Assembly shows XOR instruction xor rsi 0000000000FF002Fh in Stream UID: 10834-3217-0000000180202120 Assembly shows XOR instruction xor esi 00FF002Fh in Stream UID: 10834-3217-0000000180202120 Assembly shows XOR instruction xor al 01h in Stream UID: 10834-3219-000000018010C880 Assembly shows XOR instruction xor bpl 01h in Stream UID: 10834-3220-000000018010C790 Assembly shows XOR instruction xor ch 01h in Stream UID: 10834-3220-000000018010C790 Assembly shows XOR instruction xor edi 10000000h in Stream UID: 10834-3278-00000001801DA200 Assembly shows XOR instruction xor rcx 03h in Stream UID: 10834-3291-00000001801D5460 Assembly shows XOR instruction xor ecx 03h in Stream UID: 10834-3291-00000001801D5460 Assembly shows XOR instruction xor bl 71h in Stream UID: 10834-3424-0000000180176170 Assembly shows XOR instruction xor bpl 01h in Stream UID: 10834-3424-0000000180176170 Assembly shows XOR instruction xor ch 01h in Stream UID: 10834-3424-0000000180176170 Assembly shows XOR instruction xor al 01h in Stream UID: 10834-3426-0000000180173820 Assembly shows XOR instruction xor bpl 01h in Stream UID: 10834-3427-0000000180175200 Assembly shows XOR instruction xor ch 01h in Stream UID: 10834-3427-0000000180175200 Assembly shows XOR instruction xor dil 01h in Stream UID: 10834-3433-00000001801D5CC0 Assembly shows XOR instruction xor bh 01h in Stream UID: 10834-3433-00000001801D5CC0 Assembly shows XOR instruction xor al 01h in Stream UID: 10834-3435-0000000180175640 Assembly shows XOR instruction xor bl 01h in Stream UID: 10834-3460-000000018010C9A0 Assembly shows XOR instruction xor bpl 01h in Stream UID: 10834-3461-000000018015E890 Assembly shows XOR instruction xor ch 01h in Stream UID: 10834-3461-000000018015E890 Assembly shows XOR instruction xor ecx dword ptr [rax] in Stream UID: 10834-3464-00000001801641D0 Assembly shows XOR instruction xor eax 73h in Stream UID: 10834-3464-00000001801641D0 Assembly shows XOR instruction xor bpl 01h in Stream UID: 10834-3481-00000001800F4A50 Assembly shows XOR instruction xor ch 01h in Stream UID: 10834-3481-00000001800F4A50 Assembly shows XOR instruction xor rcx rdx in Stream UID: 10834-3504-0000000180162940 Assembly shows XOR instruction xor ecx edx in Stream UID: 10834-3504-0000000180162940 Assembly shows XOR instruction xor edx eax in Stream UID: 10834-3504-0000000180162940 Assembly shows XOR instruction xor cl al in Stream UID: 10834-3517-000000018015EC30 Assembly shows XOR instruction xor rdx 03h in Stream UID: 10834-3539-0000000180116030 Assembly shows XOR instruction xor edx 03h in Stream UID: 10834-3539-0000000180116030 Assembly shows XOR instruction xor eax 00002F3Ah in Stream UID: 10834-3542-000000018015CA40 Assembly shows XOR instruction xor ecx 2Fh in Stream UID: 10834-3542-000000018015CA40 Assembly shows XOR instruction xor dword ptr [rbp-7Bh] ecx in Stream UID: 10834-3542-000000018015CA40 Assembly shows XOR instruction xor ecx dword ptr [rdi] in Stream UID: 10834-3542-000000018015CA40 Assembly shows XOR instruction xor cl byte ptr [rcx-77h] in Stream UID: 10834-3546-000000018014D480 Assembly shows XOR instruction xor al 01h in Stream UID: 10834-3546-000000018014D480 Assembly shows XOR instruction xor al 01h in Stream UID: 10834-3550-000000018011D800 Assembly shows XOR instruction xor rsi r15 in Stream UID: 10834-3552-000000018014C080 Assembly shows XOR instruction xor esi edi in Stream UID: 10834-3552-000000018014C080 Assembly shows XOR instruction xor r8 r15 in Stream UID: 10834-3552-000000018014C080 Assembly shows XOR instruction xor eax edi in Stream UID: 10834-3552-000000018014C080 Assembly shows XOR instruction xor rdx r15 in Stream UID: 10834-3552-000000018014C080 Assembly shows XOR instruction xor edx edi in Stream UID: 10834-3552-000000018014C080 Assembly shows XOR instruction xor bl 01h in Stream UID: 10834-3553-000000018020CC70 Assembly shows XOR instruction xor al 01h in Stream UID: 10834-3564-000000018011C060 Assembly shows XOR instruction pxor xmm1 dqword ptr [0000000180243A60h] in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction pxor xmm1 dqword ptr [0000000180243A70h] in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rcx rax in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor ecx eax in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor ebp eax in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rcx r9 in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rax r8 in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rcx rdx in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor ecx edx in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rcx r8 in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rax rdx in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor eax edx in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor r8 r9 in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor eax ecx in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rdx 00000000000000FFh in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor edx 000000FFh in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rax rcx in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rbp rdx in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor ebp edx in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rbp rax in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rbp r9 in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor ebp ecx in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor r8 rbp in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor r9 r8 in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor rbp r8 in Stream UID: 10834-3581-00000001801334E0 Assembly shows XOR instruction xor bpl 01h in Stream UID: 10834-3586-000000018012F6B0 Assembly shows XOR instruction xor ch 01h in Stream UID: 10834-3586-000000018012F6B02c:T43b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm2d:T1794,Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 503016; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1086974; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1087118; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1087262; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1087406; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1289228; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1809887; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1810333; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1947616; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 2679011; code bytes = 30d0 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 316021; code bytes = 33c1 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1085506; code bytes = 33c1 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 2232635; code bytes = 33c1 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 2245224; code bytes = 33c1 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 2252266; code bytes = 33c1 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 2252330; code bytes = 33c1 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 2333293; code bytes = 33c1 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 108590; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 198688; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 811555; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1368145; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1622744; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1685048; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1703112; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 1870904; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 2519209; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 2536432; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 2845851; code bytes = 8030 Found XOR loop in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" at offset 3054996; code bytes = 8030 Found XOR loop in file "rundll32.exe" at offset 23943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 503016; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1086974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1087118; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1087262; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1087406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1289228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1809887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1810333; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1947616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2679011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 316021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1085506; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2232635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2245224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2252266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2252330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2333293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 108590; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 198688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 811555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1368145; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1622744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1685048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1703112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1870904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2519209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2536432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2845851; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3054996; code bytes = 80302e:T523,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") file/memory contains long string with (Indicator: "GetCommandLine"; File: "rundll32.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")2f:Ta31,Found system information discovery API: "GetEnvironmentStringsW" in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" Found system information discovery API: "GetNativeSystemInfo" in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" Found system information discovery API: "GetSystemInfo" in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" Found system information discovery API: "RtlNtStatusToDosError" in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" Found system information discovery API: "NtQuerySystemInformation" in file "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001304.00000000.286258.4B163000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001304.00000000.286258.4B163000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001304.00000000.286258.4B163000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00001304.00000000.286258.DAD28000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00002836.00000000.286258.4B163000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00002836.00000000.286258.4B163000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002836.00000000.286258.4B163000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002836.00000000.286258.4B163000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp"30:Tece,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001304) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002792) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005928) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002836) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008104) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008104)31:T4f7,"rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")32:Ta53,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001304) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001304) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001304) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001304) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001304) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002792) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005928) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002836) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002836) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002836) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002836) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002836) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008104) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008104) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00008104) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008104) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008104)33:T2191,"rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001304) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002792) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005928) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00002836) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00008104) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008104)34:T52e,Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")35:T738,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")36:T518,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")37:T792,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")38:T15e7,Found reference string "Cannot include self in >/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\collections\btree\map.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "ForceHttpsButUriNotHttps`Ready` polled after completion/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\future\ready.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "assertion failed: buf.len() <= c::ULONG::MAX as usize/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\std\src\sys\pal\windows\io.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "ring::error::Unspecified()/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\ops\function.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\slice\sort.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "attempt to join into collection with len > usize::MAX/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\str.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\std\src\sync\once.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\io\borrowed_buf.rs/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\collections\btree\navigate.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\cell\once.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\escape.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "assertion failed: idx < CAPACITY/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\collections\btree\node.rsassertion failed: edge.height == self.height - 1" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "library\std\src\backtrace.rsRUST_LIB_BACKTRACERUST_BACKTRACEunsupported backtracedisabled backtrace" (Indicator: "rust_backtrace"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace" (Indicator: "rust_backtrace"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "\\.\pipe\__rust_anonymous_pipe1__." (Indicator: ".\pipe\__rust_anonymous_pipe1__"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\std\src\io\mod.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\collections\vec_deque\mod.rstask was cancelledtask panicked" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\time.rsattempt to calculate the remainder with a divisor of zerooverflow in Duration::new" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "request timed out/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\str\mod.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\sync.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\slice\index.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\vec\mod.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\str\pattern.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "assertion failed: self.is_char_boundary(n)/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\string.rs" (Indicator: "/rustc/"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "rust_panic" (Indicator: "rust_panic"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference string "Cannot include self in >/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\collections\btree\map.rs" (Indicator: "/rustc/"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp")39:T540,"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" contains export function called "SLClose" at ordinal 1 "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" contains export function called "SLGetLicensingStatusInformation" at ordinal 2 "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" contains export function called "SLGetProductSkuInformation" at ordinal 3 "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" contains export function called "SLGetSLIDList" at ordinal 4 "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" contains export function called "SLOpen" at ordinal 5 "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" contains export function called "SLClose" at ordinal 1 "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" contains export function called "SLGetLicensingStatusInformation" at ordinal 2 "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" contains export function called "SLGetProductSkuInformation" at ordinal 3 "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" contains export function called "SLGetSLIDList" at ordinal 4 "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" contains export function called "SLOpen" at ordinal 53a:T5fd,"Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" in Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff, "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" in Source: 00000000-00001304.00000000.286258.4B163000.00000002.mdmp "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $name -PropertyType String -Value $value -ErrorAction Stop" in Source: 00000000-00001304.00000000.286258.4B163000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" in Source: 00000000-00002836.00000000.286258.4B163000.00000002.mdmp, "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $name -PropertyType String -Value $value -ErrorAction Stop" in Source: 00000000-00002836.00000000.286258.4B163000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" in Source: 00000000-00008104.00000000.286582.4B163000.00000002.mdmp "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $name -PropertyType String -Value $value -ErrorAction Stop" in Source: 00000000-00008104.00000000.286582.4B163000.00000002.mdmp3b:T517,"Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" in Source: 00000000-00001304.00000000.286258.4B163000.00000002.mdmp, "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $name -PropertyType String -Value $value -ErrorAction Stop" in Source: 00000000-00001304.00000000.286258.4B163000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" in Source: 00000000-00002836.00000000.286258.4B163000.00000002.mdmp "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $name -PropertyType String -Value $value -ErrorAction Stop" in Source: 00000000-00002836.00000000.286258.4B163000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" in Source: 00000000-00008104.00000000.286582.4B163000.00000002.mdmp, "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $name -PropertyType String -Value $value -ErrorAction Stop" in Source: 00000000-00008104.00000000.286582.4B163000.00000002.mdmp3c:T765,"rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb5ba40000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6fda0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6fda0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffb6fda0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6fda0000 "rundll32.exe" loaded module "KERNEL32" at base 7ffb71a50000 "rundll32.exe" loaded module "C:\09EF7C736BCCFAFEFC44D9910D499173B88063B73B221FC0DC9E9105107E5CFF.DLL" at base 7ffb4af20000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb6da80000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb70500000 "rundll32.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7ffb71a50000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 7ffb71930000 "rundll32.exe" loaded module "SSPICLI.DLL" at base 7ffb6f300000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb6ec90000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb67f30000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb68520000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffb6e7e0000 "rundll32.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffb5fc10000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffb5fcc0000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 7ffb71a50000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb6e8a0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ffb5bfb0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb70190000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\SDIAGENG.DLL" at base 7ffb517b00003d:T66d,"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180221ca1,call 0x180221cc8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180221b58,int3 ,int3 ,int3 ,jmp 0x1802222b8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0xc5da4]," "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180221ca1,call 0x180221cc8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180221b58,int3 ,int3 ,int3 ,jmp 0x1802222b8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0xc5da4]," "rundll32.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140006910,add rsp, 0x28,jmp 0x140005dec,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x5f91],jne 0x140006099,rol rcx, 0x10,test cx, 0xffff,jne 0x140006095,ret ,ror rcx, 0x10,jmp 0x1400063e0,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,xor r8d, r8d,"3e:T750,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")3f:T66a,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")40:Tef7,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SEARCHPATHMODE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")41:T410,Found string "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" (Indicator: "ping 127"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff"), Found string "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" (Indicator: "ping 127"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" (Indicator: "ping 127"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp"), Found string "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" (Indicator: "ping 127"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp")42:T428,Found string "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" (Indicator: "ping 127.0.0.1"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff"), Found string "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" (Indicator: "ping 127.0.0.1"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" (Indicator: "ping 127.0.0.1"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp"), Found string "Software\Microsoft\Windows\CurrentVersion\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q "" & del /q "\DllSafeCheck64.dll" & del /q "\slc.dll" & del /q "" (Indicator: "ping 127.0.0.1"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp")43:T47e,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WSASend" (Indicator: "WSASend"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")44:T47e,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WSASend" (Indicator: "WSASend"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")45:Tded,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "tcp open errortcp set_nonblocking errortcp bind local error" (Indicator: " bind "; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "Network unreachabletcp connect error" (Indicator: " connect "; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "tcp open errortcp set_nonblocking errortcp bind local error" (Indicator: " bind "; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "Network unreachabletcp connect error" (Indicator: " connect "; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "invalid socket address" (Indicator: " socket "; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "tcp open errortcp set_nonblocking errortcp bind local error" (Indicator: " bind "; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "Network unreachabletcp connect error" (Indicator: " connect "; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "invalid socket address" (Indicator: " socket "; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "tcp open errortcp set_nonblocking errortcp bind local error" (Indicator: " bind "; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found reference to API "Network unreachabletcp connect error" (Indicator: " connect "; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found reference to API "invalid socket address" (Indicator: " socket "; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")46:Tac98,Heuristic match: "login.microsoftonline.com" Heuristic match: "library\alloc\src\raw_vec.rs" Heuristic match: "library\alloc\src\ffi\c_str.rs" Heuristic match: "a formatting trait implementation returned an errorlibrary\alloc\src\fmt.rs" Heuristic match: "client\src\artillery\run.rs" Heuristic match: "shared\src\command\system_info.rs" Heuristic match: "program_pathshared\src\command\execute_program.rs" Heuristic match: "shared\src\command\download_file.rs" Heuristic match: "commandworking_dirtimeoutshared\src\command\cmd.rs" Heuristic match: "exit signal sent. client will shutdown.shared\src\command\exit.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\io\util\vec_with_initialized.rs" Heuristic match: "shared\src\command\upload_file.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\future\try_join.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\io\util\read_to_end.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\process\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\future\maybe_done.rs" Heuristic match: "shared\src\command\load.rs" Heuristic match: "backtrace capture failedc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\anyhow-1.0.100\src\error.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\atomic-waker-1.1.2\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\engine\general_purpose\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\decode_suffix.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\decode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.10.1\src/lib.rs" Heuristic match: "system time before unix epochc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\chrono-0.4.42\src\offset\utc.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\chrono-0.4.42\src\naive\date\mod.rs" Heuristic match: "library\core\src\net\ip_addr.rs" Heuristic match: "library\core\src\net\display_buffer.rs" Heuristic match: "library\core\src\net\parser.rs" Heuristic match: "library\core\src\net\socket_addr.rs" Heuristic match: "library\core\src\panicking.rs" Heuristic match: "library\core\src\fmt\num.rs" Heuristic match: "library\core\src\str\pattern.rs" Heuristic match: "library\core\src\str\mod.rs" Heuristic match: "smslibrary\core\src\time.rs" Heuristic match: "library\core\src\unicode\printable.rs" Heuristic match: "library\core\src\unicode\unicode_data.rs" Heuristic match: "library\core\src\escape.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-core-0.3.31\src\task\__internal\atomic_waker.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-core-3.0.0\src\identity\client_application.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tower-0.4.13\src\retry\future.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-http-3.0.0\src\client.rs" Heuristic match: "max requests in-flight; poll_ready must be called firstc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tower-0.4.13\src\limit\concurrency\service.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-oauth-3.0.0\src\identity\allowed_host_validator.rs" Pattern match: "https://graph.microsoft.comhttps://graph.microsoft.ushttps://dod-graph.microsoft.ushttps://graph.microsoft.dehttps://microsoftgraph.chinacloudapi.cnhttps://canary.graph.microsoft.com" Pattern match: "http://localhostc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-oauth-3.0.0\src\identity\credentials\app_config.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-core-3.0.0\src\http\response_converter.rs" Heuristic match: "mapaccess::next_value called before next_keyc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\serde-1.0.228\src\private\de.rs" Heuristic match: "client_idclient_secretredirect_uriresponse_moderesponse_typegrant_typepromptresourcedomain_hintlogin_hintclient_assertionclient_assertion_typecode_verifiercode_challengecode_challenge_methodadmin_consentdevice_codec:\users\runneradmin\.cargo\registry\src\i" Heuristic match: "client_credentialsc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-oauth-3.0.0\src\identity\credentials\token_credential_executor.rs" Pattern match: "login.microsoftonline.us/oauth2/v2.0/token" Heuristic match: "integer overflow when calculating buffer sizec:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-oauth-3.0.0\src\identity\credentials\confidential_client_application.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-rs-sdk-3.0.1\src\client\graph.rsc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\lazy_static-1.5.0\src\inline_lazy.rs" Heuristic match: "cannot include self in >/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\collections\btree\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\handlebars-2.0.4\src\context.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\stack.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\iterators\pairs.rs" Heuristic match: "/rust/deps\hashbrown-0.14.3\src\raw\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-1.3.1\src\uri\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-1.3.1\src\uri\authority.rs" Heuristic match: "maxsizereachedmax size reachedinvalidstatuscodeinvalid status codehttp/0.9http/2.0http/3.0c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-1.3.1\src\version.rs" Heuristic match: "\sensitiveinvalidheadervaluefailed to parse header valueinvalidmethodinvalid http methodc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-1.3.1\src\method.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\httparse-1.10.1\src/lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\httparse-1.10.1\src\simd\swar.rs" Heuristic match: "optionsgetpostputdeleteheadconnectpatchc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\proto\h1\role.rs" Heuristic match: "chunkedoriginal header value plus ascii is validc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\headers.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\body\incoming.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-1.3.1\src\uri\scheme.rs" Heuristic match: "request_methodall_proxyall_proxyhttp_proxyhttp_proxyhttps_proxyhttps_proxyno_proxyno_proxyc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-util-0.1.17\src\client\proxy\matcher.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\idna-0.5.0\src\uts46.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\idna-0.5.0\src\punycode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\unicode-normalization-0.1.25\src\decompose.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\ipnet-2.11.0\src\parser.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\iri-string-0.7.8\src\components.rs" Heuristic match: "[validity] non-relative iri must have a schemec:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\iri-string-0.7.8\src\normalize.rs" Heuristic match: "tracec:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\miniz_oxide-0.8.9\src\inflate\core.rsc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\miniz_oxide-0.8.9\src\inflate\output_buffer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\miniz_oxide-0.8.9\src\inflate\stream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\mio-1.0.4\src\sys\windows\mod.rs" Heuristic match: "phantompinnedc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\mio-1.0.4\src\sys\windows\selector.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\mio-1.0.4\src\sys\windows\iocp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\mmap-fixed-fixed-0.1.3\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\once_cell-1.21.3\src\imp_std.rs" Heuristic match: "library\panic_abort\src\lib.rs" Heuristic match: "rwlock reader count overflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\parking_lot-0.12.4\src\raw_rwlock.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\parking_lot-0.12.4\src\condvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\smallvec-1.15.1\src/lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\parking_lot_core-0.9.11\src\thread_parker\windows\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\parking_lot_core-0.9.11\src\parking_lot.rs" Heuristic match: "%00%01%02%03%04%05%06%07%08%09%0a%0b%0c%0d%0e%0f%10%11%12%13%14%15%16%17%18%19%1a%1b%1c%1d%1e%1f%20%21%22%23%24%25%26%27%28%29%2a%2b%2c%2d%2e%2f%30%31%32%33%34%35%36%37%38%39%3a%3b%3c%3d%3e%3f%40%41%42%43%44%45%46%47%48%49%4a%4b%4c%4d%4e%4f%50%51%52%53%54%" Heuristic match: "base64 is always valid headervaluec:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\util.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-1.3.1\src\extensions.rs" Heuristic match: "assertion failed: slot.is_none()c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-channel-0.3.31\src\oneshot.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\future\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tower-0.5.2\src\util\oneshot.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.10.1\src\bytes_mut.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\common\buf.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\blocking\body.rs" Heuristic match: "writer must be presentc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\write\encoder.rs" Heuristic match: "bytes remaining on streamtryflatten polled after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\try_future\try_flatten.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\sync\mpsc\unbounded.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-util-0.1.17\src\rt\tokio.rs" Heuristic match: "cannot poll select twicec:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\select.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-util-0.1.17\src\client\legacy\pool.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-util-0.1.17\src\common\lazy.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\proxy.rs" Heuristic match: "too many redirectsprevious url must be validc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\redirect.rs" Heuristic match: "assertion failed: self.inner.semaphore.is_idle()c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\sync\mpsc\chan.rs" Heuristic match: "incompletebodyc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tower-0.5.2\src\timeout\mod.rs" Heuristic match: "polled feed after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\sink\feed.rs" Heuristic match: "abort request bodyabortalready calledc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-util-0.1.17\src\service\oneshot.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\client\conn\http1.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\sync\mpsc\list.rs" Heuristic match: "pooldisabledcheckoutnolongerwantedcheckedoutclosedvalueready polled after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\ready.rs" Heuristic match: "unexpected buferrorretrying requires cloned requestc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tower-0.5.2\src\retry\future.rs" Heuristic match: "usize overflow when calculating b64 lengthc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\encode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\async_impl\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-util-0.1.17\src\client\legacy\connect\dns.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\async-compression-0.4.32\src\tokio\bufread\generic\decoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\net\tcp\socket.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-tls-0.6.0\src\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\rt\io.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.10.1\src\buf\take.rs" Heuristic match: "forcehttpsbuturinothttps`ready` polled after completion/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\future\ready.rs" Heuristic match: "proxy-authorization: c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-util-0.1.17\src\client\legacy\connect\proxy\tunnel.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\compression-core-0.4.29\src\util.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\compression-codecs-0.4.31\src\gzip\header.rs" Heuristic match: "assertion failed: buf.len() <= c::ulong::max as usize/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\std\src\sys\pal\windows\io.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\proto\h1\conn.rs" Heuristic match: "000current header namec:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\proto\h1\encode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.10.1\src\buf\chain.rs" Heuristic match: "slice must be the same length as the arrayc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\generic-array-0.14.7\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\retour-0.3.1\src\arch\memory.rs" Heuristic match: "assertion failed: crate::arch::is_within_range(displacement)c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\retour-0.3.1\src\arch\x86\thunk\x86.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\region-3.0.2\src\page.rs" Heuristic match: "sizec:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\region-3.0.2\src\util.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\retour-0.3.1\src\pic\emitter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\retour-0.3.1\src\alloc\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\retour-0.3.1\src\arch\x86\patcher.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\retour-0.3.1\src\arch\detour.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\retour-0.3.1\src\alloc\proximity.rs" Heuristic match: "assertion failed: crate::arch::is_within_range(adjusted_displacement)c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\retour-0.3.1\src\arch\x86\trampoline\mod.rs" Heuristic match: "ring::error::unspecified()/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\ops\function.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.23\src\legacy.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.23\src\v0.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.23\src\lib.rs" Heuristic match: "layouterrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\schannel-0.1.28\src\alpn_list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-1.3.1\src\header\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\client\dispatch.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\handlebars-2.0.4\src\template.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\slice\sort.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\position.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\async_impl\response.rs" Heuristic match: "attempt to join into collection with len > usize::max/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\str.rs" Heuristic match: "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhljljljljljljljljljljljljljljljljljljljljljljljljljljljljljljpnpnpnpnpnpnpnp" Heuristic match: "writing rfc3339 datetime to string should never failc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\chrono-0.4.42\src\datetime\mod.rs" Heuristic match: "successresultc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\iterators\flat_pairs.rs" Pattern match: "https://github.com/sreeise/graph-rs-sdk/issueshttps://graph.microsoft.com/.defaultassertion" Heuristic match: "dll_slc\src/lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.10.1\src\bytes.rs" Heuristic match: "`len` greater than remainingc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-body-util-0.1.3\src\util.rs" Heuristic match: "hash table capacity overflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hashbrown-0.5.0\src\raw\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-http-3.0.0\src\request_handler.rs" Heuristic match: "d:\a\antino\antino\client\src\core.rs" Heuristic match: "d:\a\antino\antino\client\src\signaller\mod.rs" Heuristic match: "d:\a\antino\antino\shared\src\command_client.rs" Heuristic match: "d:\a\antino\antino\shared\src\command\registry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\iterators\pair.rs" Heuristic match: "poll after poll::readyc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tower-0.4.13\src\util\ready.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-body-util-0.1.3\src\combinators\collect.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\serde_json-1.0.145\src\de.rs" Heuristic match: "falsetruenull{c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-channel-0.3.31\src\mpsc\mod.rs" Heuristic match: "poisoned chainc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slice-pool2-0.4.3\src\sync\mod.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\std\src\sync\once.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\socket2-0.6.0\src\sys\windows.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\io\borrowed_buf.rs/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\cell\once.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\escape.rs" Heuristic match: "library\std\src\rt.rs" Heuristic match: "library\std\src\sync\lazy_lock.rs" Heuristic match: "library\std\src\env.rs" Heuristic match: "library\std\src\io\buffered\linewritershim.rs" Heuristic match: "library\std\src\io\stdio.rs" Heuristic match: "library\std\src\thread\local.rs" Heuristic match: "stdoutstderrlibrary\std\src\io\mod.rs" Heuristic match: "library\std\src\path.rs" Heuristic match: "library\std\src\sync\once.rs" Heuristic match: "lock count overflow in reentrant mutexlibrary\std\src\sync\remutex.rs" Heuristic match: "overflow when adding duration to instantlibrary\std\src\time.rs" Heuristic match: "library\std\src\sys_common\wtf8.rs" Heuristic match: "library\std\src\sys_common\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "library\std\src\sys\pal\windows\io.rs" Heuristic match: "library\std\src\sys\pal\windows\net.rs" Heuristic match: "library\std\src\sys\pal\windows\os.rs" Heuristic match: "library\std\src\sys\pal\windows\path.rs" Heuristic match: "library\std\src\sys\pal\windows\pipe.rs" Heuristic match: "library\std\src\sys\pal\windows\process.rs" Heuristic match: "library\std\src\sys\pal\windows\rand.rs" Heuristic match: "assertion failed: snapshot.is_complete()c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\task\harness.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\std\src\io\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\io\registration.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\sync\oneshot.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\util\wake_list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\util\linked_list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\scheduler\multi_thread\park.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\io\read_buf.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\io\blocking.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\io\poll_evented.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\task\list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\sync\batch_semaphore.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\time\wheel\level.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\blocking\schedule.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\metrics\worker.rs" Heuristic match: "rng seed generator is internally corruptc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\util\rand\rt.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\io\driver.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\sync\notify.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\scheduler\multi_thread\queue.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\time\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\context.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\scheduler\current_thread\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\scheduler\multi_thread\worker.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\scheduler\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\handle.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\time\wheel\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\sync\semaphore.rs" Heuristic match: "request timed out/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\str\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\iri-string-0.7.8\src\parser\str.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\iri-string-0.7.8\src\normalize\pct_case.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\iri-string-0.7.8\src\parser\validate\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\iri-string-0.7.8\src\parser\char.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\once_cell-1.21.3\src/lib.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\sync.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\unicode-normalization-0.1.25\src\lookups.rs" Heuristic match: "httphttpswswssftpfilec:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.2\src\parser.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.2\src\host.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.2\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\form_urlencoded-1.2.2\src/lib.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\slice\index.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\vec\mod.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\str\pattern.rs" Heuristic match: "assertion failed: self.is_char_boundary(n)/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\string.rs" Heuristic match: "0123456789abcdefc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\uuid-1.18.1\src\error.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\want-0.3.1\src\lib.rs" Heuristic match: "not valid unicodeassertion failed: failc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\whoami-1.6.1\src\os\windows.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\windows-core-0.52.0\src\imp\ref_count.rs" Heuristic match: "library\alloc\src\str.rs" Heuristic match: "client\src\config\mod.rs" Heuristic match: "shared\src\command\add_to_run.rs" Heuristic match: "library\core\src\char\methods.rs" Heuristic match: "library\core\src\fmt\builders.rs" Heuristic match: "library\core\src\slice\memchr.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-http-3.0.0\src\tower_services.rs" Heuristic match: "serialize_value called before serialize_keyc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\serde_json-1.0.145\src\value\ser.rs" Pattern match: "https://graph.microsoft.com/v1.0c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\parser_state.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-1.3.1\src\header\value.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tinyvec-1.10.0\src\arrayvec.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\iri-string-0.7.8\src\parser\trusted.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\region-3.0.2\src\os\windows.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\blocking\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\async_impl\body.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-util-0.1.17\src\rt\io.rs" Heuristic match: "current header namec:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-1.7.0\src\proto\h1\encode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\connect.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\dns\gai.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\retour-0.3.1\src\arch\x86\trampoline\disasm.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\serde_json-1.0.145\src\error.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\serde_json-1.0.145\src\read.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\span.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\char\methods.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "library\std\src\panic.rs" Heuristic match: "library\std\src\sys\pal\windows\stdio.rs" Heuristic match: "library\std\src\sys\pal\windows\thread.rs" Heuristic match: "library\std\src\sys\pal\windows\thread_local_key.rs" Heuristic match: "library\std\src\sys\pal\windows\thread_parking.rs" Heuristic match: "library\std\src\sys\pal\windows\time.rs" Heuristic match: "library\std\src\sys\pal\windows\mod.rs" Heuristic match: "library\std\src\sys\pal\windows\c.rs" Heuristic match: "library\std\src\sys\pal\windows\stack_overflow.rs" Heuristic match: "assertion failed: state_and_queue.addr() & state_mask == runninglibrary\std\src\sys_common\once\queue.rs" Heuristic match: "assertion failed: len as usize >= mem::size_of::()library\std\src\sys_common\net.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\dbghelp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\time\sleep.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\scheduler\defer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\task\core.rs" Heuristic match: "[internal exception] blocking task ran twice.c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\blocking\task.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\net\tcp\stream.rs" Heuristic match: "not ready yetc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\process\windows.rs" Heuristic match: "assertion failed: next.is_notified()c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\task\state.rs" Heuristic match: "assertion failed: shared.shutdown_tx.is_some()c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\blocking\pool.rs" Heuristic match: "assertion failed: sharded_size.is_power_of_two()c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\util\sharded_list.rs" Heuristic match: "/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\std\src\thread\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\loom\std\mod.rs" Heuristic match: "cannot access a thread local storage value during or after destruction/rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\std\src\thread\local.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\context\current.rs" Heuristic match: "assertion failed: c.runtime.get().is_entered()c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\context\runtime.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\time\entry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\iri-string-0.7.8\src\normalize\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.2\src\path_segments.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\uuid-1.18.1\src\rng.rs" Pattern match: "www.tm.a.prd.aadg.akadns.net" Heuristic match: "ak.privatelink.msidentity.com" Heuristic match: "login.mso.msidentity.com" Heuristic match: "ogin.microsoftonline.com" Heuristic match: "ntrust.net" Heuristic match: "ww.tm.a.prd.aadg.akadns.net" Heuristic match: "ogin.mso.msidentity.com" Heuristic match: ".microsoftonline.com" Pattern match: "http://localhost/" Pattern match: "https://dod-graph.microsoft.us/" Pattern match: "https://canary.graph.microsoft.com/" Pattern match: "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token0" Pattern match: "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token" Pattern match: "https://microsoftgraph.chinacloudapi.cn/s" Pattern match: "https://graph.microsoft.com/.default_bpe" Pattern match: "https://graph.microsoft.com/.defaulta" Pattern match: "https://graph.microsoft.us/" Pattern match: "https://graph.microsoft.com/" Pattern match: "https://graph.microsoft.de/" Pattern match: "https://graph.microsoft.com/v1.0" Pattern match: "https://graph.microsoft.com/.default" Pattern match: "https://microsoftgraph.chinacloudapi.cn/" Heuristic match: "dapi.cn" Pattern match: "https://graph.microsoft.us/v" Pattern match: "crosoft.com/v1.0/users/fafb1f03-8029-41ef-becf-872c16f343501t06:35:53.693806100+00:00,status:online" Heuristic match: "stamp2.login.microsoftonline.com" Heuristic match: "login.microsoftonline-int.com" Heuristic match: "login.microsoftonline-p.com" Heuristic match: "login2.microsoftonline-int.com" Heuristic match: "login2.microsoftonline.com" Heuristic match: "loginex.microsoftonline-int.com" Heuristic match: "loginex.microsoftonline.com" Pattern match: "crosoft.com/v1.0/users/fafb1f03-8029-41ef-becf-872c16f34350/drive" Pattern match: "https://csp" Pattern match: "https://*.msauth.net" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://login.microsoftonline.com" Heuristic match: "stamp2.login.microsoftonline-int.com" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://localhost/t" Pattern match: "http://localhost/a" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "https://graph.microsoft.com/v1.0/users/fafb1f03-8029-41ef-becf-872c16f34350/messages?%24filter=subject+eq+%27command_req_04e1d2dc-9558-4244-a3b2-43c87c148528%27" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "https://graph.microsoft.com/v1.0/users/fafb1f03-8029-41ef-becf-872c16f34350" Pattern match: "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token3vj" Pattern match: "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token?v" Pattern match: "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token!v" Pattern match: "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token-v" Pattern match: "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/tokeniv" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "https://*.msauthimages.net" Heuristic match: "7.microsoftonline-int.com" Pattern match: "ft.bom/.default" Pattern match: "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1" Heuristic match: "host: login.microsoftonline.com" Heuristic match: "\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.47.1\src\runtime\scheduler\current_thread\mod.rs"47:T95bd,Found URL "https://graph.microsoft.comhttps://graph.microsoft.ushttps://dod-graph.microsoft.ushttps://graph.microsoft.dehttps://microsoftgraph.chinacloudapi.cnhttps://canary.graph.microsoft.comhttp://localhostc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-oauth-3.0.0\src\identity\credentials\app_config.rsabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789-_456789:;<=" - Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found URL "https://login.microsoftonline.comhttps://login.chinacloudapi.cnhttps://login.microsoftonline.dehttps://login.microsoftonline.us/oauth2/v2.0/tokencommonorganizationsconsumersadfstoken_typeexpires_inuser_idext_expires_incorrelation_idclient_infostruct" - Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found URL "https://graph.microsoft.com/v1.0c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\parser_state.rscall" - Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found URL "https://github.com/sreeise/graph-rs-sdk/issueshttps://graph.microsoft.com/.defaultassertion" - Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found URL "https://graph.microsoft.comhttps://graph.microsoft.ushttps://dod-graph.microsoft.ushttps://graph.microsoft.dehttps://microsoftgraph.chinacloudapi.cnhttps://canary.graph.microsoft.comhttp://localhostc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-oauth-3.0.0\src\identity\credentials\app_config.rsabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789-_456789:;<=" - Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found URL "https://login.microsoftonline.comhttps://login.chinacloudapi.cnhttps://login.microsoftonline.dehttps://login.microsoftonline.us/oauth2/v2.0/tokencommonorganizationsconsumersadfstoken_typeexpires_inuser_idext_expires_incorrelation_idclient_infostruct" - Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found URL "https://graph.microsoft.com/v1.0c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\parser_state.rscall" - Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found URL "https://github.com/sreeise/graph-rs-sdk/issueshttps://graph.microsoft.com/.defaultassertion" - Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found URL "https://graph.microsoft.comhttps://graph.microsoft.ushttps://dod-graph.microsoft.ushttps://graph.microsoft.dehttps://microsoftgraph.chinacloudapi.cnhttps://canary.graph.microsoft.comhttp://localhostc:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\graph-oauth-3.0.0\src\identity\credentials\app_config.rsabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789-_456789:;<=" - Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found URL "https://login.microsoftonline.comhttps://login.chinacloudapi.cnhttps://login.microsoftonline.dehttps://login.microsoftonline.us/oauth2/v2.0/tokencommonorganizationsconsumersadfstoken_typeexpires_inuser_idext_expires_incorrelation_idclient_infostruct" - Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found URL "https://graph.microsoft.com/v1.0c:\users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\pest-2.7.0\src\parser_state.rscall" - Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found URL "https://github.com/sreeise/graph-rs-sdk/issueshttps://graph.microsoft.com/.defaultassertion" - Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found URL "http://localhost/p(rowindir=c:\windowsusername=octgjgohttp://localhost/systemdrive=c:public=c:\users\public" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://dod-graph.microsoft.us/2026-08-21t06:35:53.693806100+00:00pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mschttps://canary.graph.microsoft.com/:/antino/heartbeats/04e1d2dc-9558-4244-a3b2-43c87c148528.json::/antino/heartbeats/04e1d2dc-9558-4244-a3b2-43c87c148528.json:-8processor_identifier=intel64" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token0https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token<%see/tokenphttps://microsoftgraph.chinacloudapi.cn/s" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default_bpeprogramdata=c:\programdata8f14bf5c-c0d4-40b9-9033-2f43870d29b1m8f14bf5c-c0d4-40b9-9033-2f43870d29b1rprogramw6432=c:\program" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultaioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.us/zwy2yjljyjitmdc5my00ztjmlwi5mdytztdjn2qxogexmgi2jn2qxogexmgi2https://graph.microsoft.com/zwy2yjljyjitmdc5my00ztjmlwi5mdytztdjn2qxogexmgi2zwy2yjljyjitmdc5my00ztjmlwi5mdytztdjn2qxogexmgi2microsoft" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.de/zwy2yjljyjitmdc5my00ztjmlwi5mdytztdjn2qxogexmgi2flst14bf5c-c0d4-40b9-9033-2f43870d29b1" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.004e1d2dc-9558-4244-a3b2-43c87c148528fafb1f03-8029-41ef-becf-872c16f34350fafb1f03-8029-41ef-becf-872c16f3435004e1d2dc-9558-4244-a3b2-43c87c148528fafb1f03-8029-41ef-becf-872c16f34350https://graph.microsoft.com/.defaulthttps://microsoftgraph.chinacloudapi.cn/]https://dod-graph.microsoft.us/04e1d2dc-9558-4244-a3b2-43c87c148528ioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0https://canary.graph.microsoft.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1dapi.cn8f14bf5c-c0d4-40b9-9033-2f43870d29b1ioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.08f14bf5c-c0d4-40b9-9033-2f43870d29b1https://graph.microsoft.com/.defaultioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaulthttps://graph.microsoft.de/https://graph.microsoft.com/https://graph.microsoft.us/vioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0x-ms-ests-server2026-08-21" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://localhost/policy(limit(2))correlation_idcorrelation_idgrant_ty0silent" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://localhost/timestamp2026-08-21" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaulthttps://graph.microsoft.com/.defaultioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default8f14bf5c-c0d4-40b9-9033-2f43870d29b1https://graph.microsoft.com/.defaultioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default8f14bf5c-c0d4-40b9-9033-2f43870d29b1https://graph.microsoft.com/.default8f14bf5c-c0d4-40b9-9033-2f43870d29b18f14bf5c-c0d4-40b9-9033-2f43870d29b1ioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultbasic" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://rpku2uwitheachinlineltlineeachs" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://csp.duhqfp5wc86q0cdxyeaqaaagpcecookd;" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.msauth.net" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.msftauth.net" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.msftauthimages.net" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.msauthimages.net" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.msidentity.com" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.microsoftonline-p.com" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.microsoftazuread-sso.com" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.azureedge.net" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.outlook.com" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.office.com" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.office365.com" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.microsoft.com" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://*.bing.com" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://csp.microsoft.com/report/ests-ux-allx-xss-protection:" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://login.microsoftonline.comef6b9cb2-0793-4e2f-b906-e7c7d18a10b6aultlogin.microsoftonline.com*$2.5.4.38f14bf5c-c0d4-40b9-9033-2f43870d29b1https://graph.microsoft.com/.defaultioh8q" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0sxx$uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c389_o38[7z9" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnatt" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://:inlinex-ms-srsgttps://errortrace_iderrornot?trace_id" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0/users/fafb1f03-8029-41ef-becf-872c16f34350/messages?%24filter=subject+eq+%27command_req_04e1d2dc-9558-4244-a3b2-43c87c148528%27thawte," - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0/users/fafb1f03-8029-41ef-becf-872c16f343501.2.840.10045.3.1.4@eckp1.2.840.10045.3.1.5@eckp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.5ecdp1.2.840.10045.3.1.2ecdp1.2.840.10045.3.1.6@eckp1.2.840.10045.3.1.2@eckprrelb9b35-be8" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/tokenhttps://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/tokenlmem8https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/tokenhttps://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token3vjhttps://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token?vhttps://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token!vhttps://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token-v-903lmem8.0/tokenhttps://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/tokenlmem8lmem@https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/tokenivlmem@https://graph.microsoft.com/v1.0/users/fafb1f03-8029-41ef-becf-872c16f34350https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token+'nzte3e(z+q71rsa10yykcahbwv$_ntyecahbwv$_ntyersa10yykcahbwv$_ntyeflstlmemhlmemhlmemhlmemhlmemhlmemhlmemhlmemh170531232859z180601232859z0.files-df.1drv.com1.files.1drv.com1.aadrm.com1&0.afx.ms1&0.akadns.net1&0.aspnetcdn.com1.azure-int.net1&0.azure-mobile.net1.azure.com1&0.cloudapp.azure.com1" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008104.00000000.286582.E31D0000.00000004.mdmp") Found URL "http://localhost/p(rowindir=c:\windowsusername=octgjgohttp://localhost/systemdrive=c:public=c:\users\public" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://dod-graph.microsoft.us/pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mschttps://canary.graph.microsoft.com/%lkcv%lkcv:/antino/heartbeats/04e1d2dc-9558-4244-a3b2-43c87c148528.json:-8processor_identifier=intel64" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token0https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token<%see/tokenphttps://microsoftgraph.chinacloudapi.cn/s" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default_bpeprogramdata=c:\programdata8f14bf5c-c0d4-40b9-9033-2f43870d29b1m8f14bf5c-c0d4-40b9-9033-2f43870d29b1rprogramw6432=c:\program" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultaioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.us/zwy2yjljyjitmdc5my00ztjmlwi5mdytztdjn2qxogexmgi2jn2qxogexmgi2https://graph.microsoft.com/zwy2yjljyjitmdc5my00ztjmlwi5mdytztdjn2qxogexmgi2zwy2yjljyjitmdc5my00ztjmlwi5mdytztdjn2qxogexmgi2microsoft" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.de/zwy2yjljyjitmdc5my00ztjmlwi5mdytztdjn2qxogexmgi2flst14bf5c-c0d4-40b9-9033-2f43870d29b1" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.004e1d2dc-9558-4244-a3b2-43c87c148528fafb1f03-8029-41ef-becf-872c16f34350fafb1f03-8029-41ef-becf-872c16f3435004e1d2dc-9558-4244-a3b2-43c87c148528fafb1f03-8029-41ef-becf-872c16f34350https://graph.microsoft.com/.defaulthttps://microsoftgraph.chinacloudapi.cn/]https://dod-graph.microsoft.us/04e1d2dc-9558-4244-a3b2-43c87c148528ioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0https://canary.graph.microsoft.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1dapi.cn8f14bf5c-c0d4-40b9-9033-2f43870d29b1ioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.08f14bf5c-c0d4-40b9-9033-2f43870d29b1https://graph.microsoft.com/.defaultioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaulthttps://graph.microsoft.de/https://graph.microsoft.com/https://graph.microsoft.us/vioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0http://localhost/:57zpolicy(limit(2))rkerhttp://localhost/policy(limit(2))tokio-runtime-workercorrelathttp://localhost/grant_ty0grant_tysilent" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://localhost/http://localhost/http://localhost/grant_tyvdnkp126jypeku8http://localhost/2026-08-http://localhost/okio-runtime-workerclient_i0scope=htphttp://localhost/scope=htpwindows" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaulthttps://graph.microsoft.com/.defaultioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default8f14bf5c-c0d4-40b9-9033-2f43870d29b1https://graph.microsoft.com/.defaultioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default8f14bf5c-c0d4-40b9-9033-2f43870d29b1https://graph.microsoft.com/.default8f14bf5c-c0d4-40b9-9033-2f43870d29b18f14bf5c-c0d4-40b9-9033-2f43870d29b1ioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultk" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://rpku2uheaptrace_idtheapandhheapheapinlineheapr),-\heape_idcheapheape=heaps://fheaporthunlesswithupbasic" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.msauthimages.net" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.msidentity.com" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.microsoftonline-p.com" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.microsoftazuread-sso.com" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.azureedge.net" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.outlook.com" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.office.com" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.office365.com" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.microsoft.com" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.bing.com" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://csp.microsoft.com/report/ests-ux-allx-xss-protection:" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.msauth.net" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.msftauth.net" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.msftauthimages.net" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://.defaultault29b12.5.29.1-bb69-4f22-adf9-02d64ed0c200_bpe[zonetransfer]zoneid=0ioh8q" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0sxx$uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c389_o38[7z9" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://graph.microsoft.com/v1.0/users/fafb1f03-8029-41ef-becf-872c16f343501.2.840.10045.3.1.7@eckp" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1th2/v2.0/tokenhttps://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token?vhttps://login.microsoftonline.com/8f14bf5c-c0d4-40b9-9033-2f43870d29b1/oauth2/v2.0/token!vlmem8kwevy+'nzte3e(z+q71rsa10yykcahbwv$_ntyep8go0[iorsa10yykcahbwv$_ntyeflstlmemhlmemhlmemhlmemhlmemhlmemh170531232859z180601232859z0.files-df.1drv.com1.files.1drv.com1.aadrm.com1&0.afx.ms1&0.akadns.net1&0.aspnetcdn.com1.azure-int.net1&0.azure-mobile.net1.azure.com1&0.cloudapp.azure.com1" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008104.00000001.287921.E31D0000.00000004.mdmp") Found URL "https://*.msauth.net" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.msftauth.net" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.msftauthimages.net" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.msauthimages.net" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.msidentity.com" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.microsoftonline-p.com" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.microsoftazuread-sso.com" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.azureedge.net" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.outlook.com" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.office.com" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.office365.com" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.microsoft.com" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://*.bing.com" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://csp.microsoft.com/report/ests-ux-allx-xss-protection:" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found URL "https://csp.duhqfp5wc86q0cdxyeaqaaagpcecookd;" - Source: "00000000-00008104.00000001.287921.E5940000.00000004.mdmp")48:T4da,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")49:T1337,Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\engine\general_purpose\mod.rs" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\decode_suffix.rs" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\decode.rs" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\mod.rs" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "integer overflow when calculating buffer sizeC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\mod.rs" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "Base64 error:" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "base64 is always valid HeaderValueC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.12.23\src\util.rs" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "Writer must be presentC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\write\encoder.rs" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "usize overflow when calculating b64 lengthC:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\encode.rs" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "InvalidTokenInvalidSignatureInvalidEcdsaKeyInvalidRsaKeyRsaFailedSigningInvalidAlgorithmNameInvalidKeyFormatMissingRequiredClaimExpiredSignatureInvalidIssuerInvalidAudienceInvalidSubjectImmatureSignatureInvalidAlgorithmMissingAlgorithmBase64" (Indicator: "base64"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "InvalidTokenInvalidSignatureInvalidEcdsaKeyInvalidRsaKeyRsaFailedSigningInvalidAlgorithmNameInvalidKeyFormatMissingRequiredClaimExpiredSignatureInvalidIssuerInvalidAudienceInvalidSubjectImmatureSignatureInvalidAlgorithmMissingAlgorithmBase64" (Indicator: "ecdsa"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "aesdec" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "aesdeclast" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "aesenc" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "aesenclast" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "aesimc" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "aeskeygenassist" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "vaesdec" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "vaesdeclast" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "vaesenc" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "vaesenclast" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "vaesimc" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "vaeskeygenassist" (Indicator: "aes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.22.1\src\engine\general_purpose\mod.rs" (Indicator: "base64"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\decode_suffix.rs" (Indicator: "base64"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\engine\general_purpose\decode.rs" (Indicator: "base64"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp")4a:T736,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")4b:T1025,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")4c:T4c0,Found reference to API "ReadFile" (Indicator: "ReadFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtReadFile" (Indicator: "NtReadFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")4d:Ta62,Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")4e:T1013,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")4f:T5c6,Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")50:T714,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")51:T496,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtWriteFile" (Indicator: "NtWriteFile"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "NtWriteFile" (Indicator: "NtWriteFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtWriteFile" (Indicator: "NtWriteFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "NtWriteFile" (Indicator: "NtWriteFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")52:Ta3d,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFILTER"; Key: "SUPPORTEDFEATURES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")53:T602,Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; File: "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00001304.00000000.286258.DAD28000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002836.00000000.286258.4B163000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp")54:Tb2f,"rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")55:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC56:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC57:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC58:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC59:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5a:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5b:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791121700656,"unified_at":"2026-10-04T13:48:20.656Z","metadata":{"hashes":{"sha256":"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","sha1":"13b2809d42c3ce491008b2dca40ff86551be7897","md5":"80f759cdef77ce76d6b7cf4db20bcbe9","sha512":"0f3318e3698b9e054f02ae5a58ab3b8c565f23ba028165c677f75440b0b9d4b07abcb90c8f02aa6adf7680372eaf12c1e0f4f1a4d2e03a0c7bc9fe8ef9385d87","ssdeep":"49152:J12Cc05Ciikd9wjEMrV3bVjKlsRZ2GVus/yCJTYm9/F99rD2agxylCAYrHup:P2CczEaLVjKiRZ99ehAYrHk","ssdeep_chunks":["49152:J12Cc05","49152:12Cc05C","49152:2Cc05Ci","49152:Cc05Cii","49152:c05Ciik","49152:05Ciikd","49152:5Ciikd9","49152:Ciikd9w","49152:iikd9wj","49152:ikd9wjE","49152:kd9wjEM","49152:d9wjEMr","49152:9wjEMrV","49152:wjEMrV3","49152:jEMrV3b","49152:EMrV3bV","49152:MrV3bVj","49152:rV3bVjK","49152:V3bVjKl","49152:3bVjKls","49152:bVjKlsR","49152:VjKlsRZ","49152:jKlsRZ2","49152:KlsRZ2G","49152:lsRZ2GV","49152:sRZ2GVu","49152:RZ2GVus","49152:Z2GVus/","49152:2GVus/y","49152:GVus/yC","49152:Vus/yCJ","49152:us/yCJT","49152:s/yCJTY","49152:/yCJTYm","49152:yCJTYm9","49152:CJTYm9/","49152:JTYm9/F","49152:TYm9/F9","49152:Ym9/F99","49152:m9/F99r","49152:9/F99rD","49152:/F99rD2","49152:F99rD2a","49152:99rD2ag","49152:9rD2agx","49152:rD2agxy","49152:D2agxyl","49152:2agxylC","49152:agxylCA","49152:gxylCAY","49152:xylCAYr","49152:ylCAYrH","49152:lCAYrHu","49152:CAYrHup","98304:J12Cc05","98304:12Cc05C","98304:2Cc05Ci","98304:Cc05Cii","98304:c05Ciik","98304:05Ciikd","98304:5Ciikd9","98304:Ciikd9w","98304:iikd9wj","98304:ikd9wjE","98304:kd9wjEM","98304:d9wjEMr","98304:9wjEMrV","98304:wjEMrV3","98304:jEMrV3b","98304:EMrV3bV","98304:MrV3bVj","98304:rV3bVjK","98304:V3bVjKl","98304:3bVjKls","98304:bVjKlsR","98304:VjKlsRZ","98304:jKlsRZ2","98304:KlsRZ2G","98304:lsRZ2GV","98304:sRZ2GVu","98304:RZ2GVus","98304:Z2GVus/","98304:2GVus/y","98304:GVus/yC","98304:Vus/yCJ","98304:us/yCJT","98304:s/yCJTY","98304:/yCJTYm","98304:yCJTYm9","98304:CJTYm9/","98304:JTYm9/F","98304:TYm9/F9","98304:Ym9/F99","98304:m9/F99r","98304:9/F99rD","98304:/F99rD2","98304:F99rD2a","98304:99rD2ag","98304:9rD2agx","98304:rD2agxy","98304:D2agxyl","98304:2agxylC","98304:agxylCA","98304:gxylCAY","98304:xylCAYr","98304:ylCAYrH","98304:lCAYrHu","98304:CAYrHup","49152:P2CczEa","49152:2CczEaL","49152:CczEaLV","49152:czEaLVj","49152:zEaLVjK","49152:EaLVjKi","49152:aLVjKiR","49152:LVjKiRZ","49152:VjKiRZ9","49152:jKiRZ99","49152:KiRZ99e","49152:iRZ99eh","49152:RZ99ehA","49152:Z99ehAY","49152:99ehAYr","49152:9ehAYrH","49152:ehAYrHk"],"imphash":"90d852cc80c444d62d6704bf9950d3ac","pehash":"2409fb965c75f84edef5b19ed3c1294e9bbe15cd"},"file_info":{"file_name":"SLC.DLL","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":3169792,"entropy":6.16,"compile_timestamp":"2026-01-11T07:54:37","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1775029607000,"last_seen":1788047639000,"last_multi_scan":1788047639000},"pe_metadata":{"is_dll":true,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":2366528,"raw_size":2366976},{"name":".rdata","virtual_address":"0x243000","virtual_size":583040,"raw_size":583168},{"name":".data","virtual_address":"0x2d2000","virtual_size":96712,"raw_size":91648},{"name":".pdata","virtual_address":"0x2ea000","virtual_size":40380,"raw_size":40448},{"name":".cfg","virtual_address":"0x2f4000","virtual_size":65536,"raw_size":65536},{"name":".fptable","virtual_address":"0x304000","virtual_size":256,"raw_size":512},{"name":".rsrc","virtual_address":"0x305000","virtual_size":1400,"raw_size":1536},{"name":".reloc","virtual_address":"0x306000","virtual_size":18900,"raw_size":18944}],"section_names":[".text",".rdata",".data",".pdata",".cfg",".fptable",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["analysis"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":167,"suspicious_count":13,"malicious_count":1,"total":181},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Fsysna","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Midie.76870","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Midie-10060391-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Qwexlafiba_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/RustyEtiquette.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 00584baa1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Antino-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Generic Trojan.zbm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Fsysna.Win32.69973","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win64/RustyEtiquette.A trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Uses Rust based deflate/zlib compression/decompression library"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"},{"type":"informative","value":"Contains ability to check internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Contains ability to create directories"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Uses Rust compression library for archiving"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"suspicious","value":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1L9\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"HTTP/1.0L9\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"t_secretH\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"t_secretH1\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"passwordH\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"o\\Device\\Afd\\Mio\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$25","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00008104.00000000.286582.E31D0000.00000004.mdmp, 00000000-00008104.00000001.287921.E31D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL\\cmd.exemaximum number of ProcThreadAttributes exceeded; Source: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found string - \\\\.\\NUL\\cmd.exemaximum number of ProcThreadAttributes exceeded; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found string - \\\\.\\NUL\\cmd.exemaximum number of ProcThreadAttributes exceeded; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found string - \\\\.\\NUL\\cmd.exemaximum number of ProcThreadAttributes exceeded; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007884]\n Process \"WerFault.exe\" [UID: 00000000-00006856]\n Process \"WerFault.exe\" [UID: 00000000-00006140]\n Process \"WerFault.exe\" [UID: 00000000-00002860]\n Process \"WerFault.exe\" [UID: 00000000-00004568]\n Process \"WerFault.exe\" [UID: 00000000-00005380]\n Process \"WerFault.exe\" [UID: 00000000-00003360]\n Process \"WerFault.exe\" [UID: 00000000-00001616]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Uses Rust based deflate/zlib compression/decompression library","description":"Found string \"TRACEC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\core.rsC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\output_buffer.rs\" (Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"TRACEC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\core.rsC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\output_buffer.rs\" (Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"TRACEC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\core.rsC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\output_buffer.rs\" (Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-636","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Uses Rust compression library for archiving","description":"Found string \"TRACEC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\core.rsC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\output_buffer.rs\" (Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"TRACEC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\core.rsC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\output_buffer.rs\" (Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"TRACEC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\core.rsC:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\miniz_oxide-0.8.9\\src\\inflate\\output_buffer.rs\" (Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":3,"id":"string-637","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001304.00000000.286258.FC080000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002792.00000000.286260.B7CD0000.00000004.mdmp\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001304.00000000.286258.FC080000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002792.00000000.286260.B7CD0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002836.00000000.286258.4F2E0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005928.00000000.286260.DE1D0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00008104.00000000.286582.E31D0000.00000004.mdmp, 00000000-00008104.00000001.287921.E31D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00008104.00000000.286582.E31D0000.00000004.mdmp, 00000000-00008104.00000001.287921.E31D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2c","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n file/memory contains long string with (Indicator: \"github.com\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"github.com\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"github.com\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"rundll32.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"rundll32.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001304)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002792)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001304)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002792)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005928)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002836)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008104)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: rundll32.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@kernel32.dll at 10834-3262-00000001801E3FF0\n FindFirstFileW@kernel32.dll at 10834-13340-00000001800267E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@kernel32.dll at 10834-13147-0000000180221CE9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@kernel32.dll at 10834-13147-0000000180221CE9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@kernel32.dll at 10834-3428-0000000180177AA0\n GetSystemInfo@kernel32.dll at 10834-3429-00000001802218CC\n GetNativeSystemInfo@kernel32.dll at 10834-3650-0000000180110500","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@kernel32.dll at 10834-3197-000000018021F5D0\n GetProcessHeap@kernel32.dll at 10834-3198-000000018021F520\n GetProcessHeap@kernel32.dll at 10834-11300-000000018021F386","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: C:\\09EF7C736BCCFAFEFC44D9910D499173B88063B73B221FC0DC9E9105107E5CFF.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"rundll32.exe\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$31","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"rundll32.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Windows GatherOSStateKit (UID: 00000000-00008104)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\a\\antino\\antino\\target\\x86_64-pc-windows-msvc\\release\\deps\\slc_template.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.dll at 10834-10846-00000001801EED78","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@kernel32.dll at 10834-3238-00000001801DD590\n WaitForSingleObject@kernel32.dll at 10834-3259-00000001801D85C0\n WaitForSingleObject@kernel32.dll at 10834-3936-0000000180068EC0\n WaitForSingleObject@kernel32.dll at 10834-4099-0000000180202340\n WaitForSingleObject@kernel32.dll at 10834-4100-00000001800214B0\n RegisterWaitForSingleObject@kernel32.dll at 10834-4702-00000001800219AB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@kernel32.dll at 10834-3238-00000001801DD590","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"$38","origin":"File/Memory","relevance":1,"id":"string-943","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$39","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"DLL with no export directory","description":"\"rundll32.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"","origin":"Static Parser","relevance":1,"id":"static-91","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"rundll32.exe\" as clean (type is \"PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"Process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#1\" (UID: 00000000-00001304)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#2\" (UID: 00000000-00002792)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#4\" (UID: 00000000-00005928)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#3\" (UID: 00000000-00002836)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#5\" (UID: 00000000-00008104)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"rundll32.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\__rust_anonymous_pipe1__.","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Internal error please file an issue on GitHub https://github.com/sreeise/graph-rs-sdk/issueshttps://graph.microsoft.com/.defaultassertion failed: (*tail).value.is_none()C:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-6f17d22bba15001f\\futures-channel-0.3.31\\src\\mpsc\\queue.rs\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 70500000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6EF60000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 71930000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"rundll32.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"rundll32.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"rundll32.exe\" touched \"CScriptedDiag\" (Path: \"HKCU\\CLSID\\{1F3D8AA5-9EBF-4EE4-85C2-EA40379AEDE8}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"rundll32.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\" has an executable section named \".text\"\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" has an executable section named \".text\"\n \"rundll32.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\" has an writable section named \".data\"\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\" has an writable section named \".fptable\"\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" has an writable section named \".data\"\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" has an writable section named \".fptable\"\n \"rundll32.exe\" has an writable section named \".data\"\n \"rundll32.exe\" has an writable section named \".didat\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x241e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x241c40\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\" has high imagebase \"0x180000000\"\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" has high imagebase \"0x180000000\"\n \"rundll32.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00001304) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00001304) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"login.microsoftonline.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"Software\\Microsoft\\Windows\\CurrentVersion\\Runping 127.0.0.1 -n 3 > nul && rmdir /s /q \"\" & del /q \"\\DllSafeCheck64.dll\" & del /q \"\\slc.dll\" & del /q \"\" [Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107 ...\" (UID: 00000000-00002792), Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107 ...\" (UID: 00000000-00005928)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107 ...\" (UID: 00000000-00002836), Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107 ...\" (UID: 00000000-00008104)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107 ...\" (UID: 00000000-00002792), Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107 ...\" (UID: 00000000-00005928)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107 ...\" (UID: 00000000-00002836), Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107 ...\" (UID: 00000000-00008104)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n file/memory contains long string(Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n file/memory contains long string(Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"- Location: [%LOCALAPPDATA%\\Windows GatherOSStateKit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll]- [targetUID: 00000000-00001304]\n \"rundll32.exe\" has type \"PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections\"- Location: [%LOCALAPPDATA%\\Windows GatherOSStateKit\\rundll32.exe]- [targetUID: 00000000-00001304]\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"- Location: [%LOCALAPPDATA%\\Windows GatherOSStateKit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll]- [targetUID: 00000000-00001304]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 1304)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 2792)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 5928)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 2836)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 8104)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"rundll32.exe\" reads file \"c:\\windows\\system32\\rundll32.exe\"\n \"rundll32.exe\" reads file \"c:\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\"\n \"rundll32.exe\" reads file \"c:\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll:zone.identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Able to perform sandbox evasion using APIs\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"\\Device\\CNG\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernelbase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\System32\\FLTLIB.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\System32\\VCRUNTIME140.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\System32\\VCRUNTIME140_1.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\bcrypt.dll\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\SECUR32.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\secur32.dll\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\CRYPTBASE.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\SSPICLI.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\09EF7C736BCCFAFEFC44D9910D499173B88063B73B221FC0DC9E9105107E5CFF.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\09EF7C736BCCFAFEFC44D9910D499173B88063B73B221FC0DC9E9105107E5CFF.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\09EF7C736BCCFAFEFC44D9910D499173B88063B73B221FC0DC9E9105107E5CFF.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\09EF7C736BCCFAFEFC44D9910D499173B88063B73B221FC0DC9E9105107E5CFF.DLL.2.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\windows gatherosstatekit\\rundll32.exe\"\n \"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\windows gatherosstatekit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\"\n \"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\windows gatherosstatekit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll:zone.identifier\"\n \"rundll32.exe\" writes file \"%localappdata%\\windows gatherosstatekit\\rundll32.exe\"\n \"rundll32.exe\" writes file \"%localappdata%\\windows gatherosstatekit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll:zone.identifier\"\n \"rundll32.exe\" writes file \"%localappdata%\\windows gatherosstatekit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"$41","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff]\n Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"$42","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1:34254could not resolve to any addresses\"\n Potential IP \"11.76.6.1\" found in string \"11.76.6.1!7\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.3\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://graph.microsoft.comhttps\"\n Found HTTPS url \"https://dod\"\n Found HTTPS url \"https://graph.microsoft.dehttps\"\n Found HTTPS url \"https://canary.graph.microsoft.com\"\n Found HTTPS url \"https://login.microsoftonline.comhttps\"\n Found HTTPS url \"https://login.microsoftonline.dehttps\"\n Found HTTPS url \"https://github.com\"\n Found HTTPS url \"https://graph.microsoft.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00002792\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Rust-compiled binary","description":"YARA signature for Rust-compiled binary file \"sample.bin\"\n YARA signature for Rust-compiled binary file \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll.77459302\"","origin":"YARA Signature","relevance":1,"id":"yara-185","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00008104.00000000.286582.E31D0000.00000004.mdmp, 00000000-00008104.00000001.287921.E31D0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00008104.00000000.286582.E31D0000.00000004.mdmp, 00000000-00008104.00000001.287921.E31D0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00008104.00000000.286582.E31D0000.00000004.mdmp, 00000000-00008104.00000001.287921.E31D0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00008104.00000000.286582.E31D0000.00000004.mdmp, 00000000-00008104.00000001.287921.E31D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00008104)\n \"rundll32.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp, 00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001304.00000000.286258.DAD28000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: rundll32.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"New-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -Name $name -PropertyType String -Value $value -ErrorAction Stop\" (Indicator: \"New-ItemProperty\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"New-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -Name $name -PropertyType String -Value $value -ErrorAction Stop\" (Indicator: \"New-ItemProperty\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"New-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -Name $name -PropertyType String -Value $value -ErrorAction Stop\" (Indicator: \"New-ItemProperty\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp, 00000000-00008104.00000001.287921.E5940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001304.00000000.286258.4B163000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002836.00000000.286258.4B163000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00008104.00000000.286582.4B163000.00000002.mdmp\n 00000000-00008104.00000001.287921.E5940000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00008104.00000000.286582.E31D0000.00000004.mdmp, 00000000-00008104.00000001.287921.E31D0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" - Location: [%LOCALAPPDATA%\\Windows GatherOSStateKit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll]- [targetUID: 00000000-00001304]\n Dropped file: \"rundll32.exe\" - Location: [%LOCALAPPDATA%\\Windows GatherOSStateKit\\rundll32.exe]- [targetUID: 00000000-00001304]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".cfg\" has very low entropy (0.06)\n indicating potential NOP sled\n Section \".data\" has very low entropy (0.44)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00001304.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002836.00000000.286258.4B163000.00000002.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00008104.00000000.286582.4B163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/24 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@kernel32.dll at 10834-10710-00000001801E33A3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"- Location: [%LOCALAPPDATA%\\Windows GatherOSStateKit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll]- [targetUID: 00000000-00001304]\n \"rundll32.exe\" has type \"PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections\"- Location: [%LOCALAPPDATA%\\Windows GatherOSStateKit\\rundll32.exe]- [targetUID: 00000000-00001304]\n \"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"rundll32.exe\" wrote 5632 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Windows GatherOSStateKit\\rundll32.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@kernel32.dll at 10834-5028-00000001800384AB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@kernel32.dll at 10834-4099-0000000180202340","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$54","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtWriteFile@ntdll.dll at 10834-3259-00000001801D85C0\n NtCreateFile@ntdll.dll at 10834-7800-000000018010DDD3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameW\n RegDeleteValueW\n RegOpenKeyExW\n GetCommandLineW\n WriteFile\n GetCommandLineA\n WriteFileEx\n IsDebuggerPresent\n CreateProcessW\n GetFileAttributesW\n GetNativeSystemInfo\n GetComputerNameExW\n CreateFileW\n SleepEx\n GetModuleFileNameW\n VirtualProtect\n CreateDirectoryW\n GetModuleHandleExA\n GetTempPathW\n CreateThread\n FindFirstFileExW\n VirtualAlloc\n CopyFileExW\n FindNextFileW\n Sleep\n GetModuleFileNameA\n GetSystemInfo\n LoadLibraryExW\n GetModuleHandleW\n LoadLibraryExA\n FindFirstFileW\n GetStartupInfoW\n UnhandledExceptionFilter\n LoadLibraryA\n DeleteFileW\n GetSystemDirectoryW\n TerminateProcess\n GetModuleHandleExW\n GetProcAddress\n GetModuleHandleA\n bind\n WSASocketW\n closesocket\n connect\n WSAStartup\n WSASend\n send\n recv\n OutputDebugStringW\n GetTickCount\n NtQueryInformationToken","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"rundll32.exe\" claims program is from Fri Apr 2 02:35:44 2032","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]}],"incidents":[{"name":"Evasive","details_count":2,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]}],"intel_graph":{"map":{"Domain:33bc226605f31513b42b8cad8160422db7823cc505e53461b2e6c0d2fa6db8cf":{"type":"Domain","value":"login.microsoftonline.com","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff":{"type":"File","value":"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]},"filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 8 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33":{"type":"File","value":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},"File:b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6":{"type":"File","value":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6"}},"chains":[{"id":"1543408415868483170","root":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]}},{"id":"1543408442011796995","root":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","edges":[{"edge_kind":"contacted_domain","from_key":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","to_key":"Domain:33bc226605f31513b42b8cad8160422db7823cc505e53461b2e6c0d2fa6db8cf"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"sandbox_network","root":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","edges":[{"edge_kind":"contacted_domain","from_key":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","to_key":"Domain:33bc226605f31513b42b8cad8160422db7823cc505e53461b2e6c0d2fa6db8cf"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","edges":[{"edge_kind":"extracted","from_key":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","to_key":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff"},{"edge_kind":"extracted","from_key":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","to_key":"File:b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6"},{"edge_kind":"extracted","from_key":"File:09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","to_key":"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["analysis"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","User Comment"],"sandbox_reports":[{"id":"6a87f1927f0aea3fe00956d7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"Gen:Variant.Application.Midie","contacted_countries":["USA"],"submit_name":"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","analysis_start_time":"2026-08-21T06:34:59+00:00","indicators_count":{"informative":167,"suspicious":36,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"login.microsoftonline.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]}],"http_requests":null,"embedded_domains":[{"value":"login.microsoftonline.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}],"processes":[{"pid":6756,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00006756"},{"pid":1304,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#1","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00001304","icon":"$55"},{"pid":2792,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#2","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002792","icon":"$56"},{"pid":5928,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#4","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00005928","icon":"$57"},{"pid":2836,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#3","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002836","icon":"$58"},{"pid":6856,"ppid":2836,"name":"WerFault.exe","command_line":"-u -p 2836 -s 400","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002836","uid":"00000000-00006856"},{"pid":6140,"ppid":2836,"name":"WerFault.exe","command_line":"-u -p 2836 -s 400","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002836","uid":"00000000-00006140"},{"pid":2860,"ppid":2836,"name":"WerFault.exe","command_line":"-u -p 2836 -s 400","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002836","uid":"00000000-00002860"},{"pid":7884,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 2836 -ip 2836","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007884","icon":"$59"},{"pid":8104,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll\",#5","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00008104","icon":"$5a"},{"pid":5380,"ppid":8104,"name":"WerFault.exe","command_line":"-u -p 8104 -s 1364","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008104","uid":"00000000-00005380"},{"pid":3360,"ppid":8104,"name":"WerFault.exe","command_line":"-u -p 8104 -s 1364","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008104","uid":"00000000-00003360"},{"pid":1616,"ppid":8104,"name":"WerFault.exe","command_line":"-u -p 8104 -s 1364","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008104","uid":"00000000-00001616"},{"pid":4568,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 8104 -ip 8104","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004568","icon":"$5b"}],"all_imported_dlls":["SHCore.dll","mswsock.dll","schannel.dll","cryptnet.dll","sdiageng.dll","bcryptprimitives.dll","msvcp_win.dll","cryptsp.dll","cryptbase.dll","sspicli.dll","msvcrt.dll","ws2_32.dll","user32.dll","KernelBase.dll","vcruntime140.dll","09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll","rasadhlp.dll","kernel32.dll","rpcrt4.dll","profapi.dll","ucrtbase.dll","vcruntime140_1.dll","advapi32.dll","sechost.dll","crypt32.dll","secur32.dll","gdi32.dll","uxtheme.dll","mskeyprotect.dll","ntdll.dll","imm32.dll","oleaut32.dll","dnsapi.dll","FWPUCLNT.DLL","clbcatq.dll","userenv.dll","win32u.dll","ncrypt.dll","ncryptsslp.dll","gdi32full.dll","msasn1.dll","msctf.dll","IPHLPAPI.DLL","ntasn1.dll","rsaenh.dll","ntmarta.dll","gpapi.dll","ole32.dll","dwmapi.dll","nsi.dll","VxSSL64.dll","shlwapi.dll","bcrypt.dll","kernel.appcore.dll","combase.dll","imagehlp.dll","fltLib.dll","msvcp140.dll","wintrust.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll","sha256":"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"name":"rundll32.exe","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"name":"09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Windows GatherOSStateKit\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"path":"%LOCALAPPDATA%\\Windows GatherOSStateKit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"path":"%LOCALAPPDATA%\\Windows GatherOSStateKit\\09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff.dll:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a87f1927f0aea3fe00956d7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6a87f1927f0aea3fe00956d7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win64/RustyEtiquette.A trojan Sample 09ef7c736bcc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 09ef7c736bcc…. Malware family: Win64/RustyEtiquette.A trojan. Threat score 100/100. 11/24 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/RustyEtiquette.A trojan Sample 09ef7c736bcc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 09ef7c736bcc…. Malware family: Win64/RustyEtiquette.A trojan. Threat score 100/100. 11/24 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/RustyEtiquette.A trojan Sample 09ef7c736bcc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 09ef7c736bcc…. Malware family: Win64/RustyEtiquette.A trojan. Threat score 100/100. 11/24 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]]