24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TROJ_FR.9C2019CD Sample 296599df29f4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 296599df29f4…. Malware family: TROJ_FR.9C2019CD. Threat score 100/100. 16/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605","keywords":["Malicious","TROJ_FR.9C2019CD","malware analysis","sandbox report","threat intelligence","296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605"],"about":{"@type":"SoftwareApplication","name":"Tezis_30.09.2022.docx.exe","applicationCategory":["peexe","executable"],"identifier":"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TROJ_FR.9C2019CD","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8c4,"AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "open") "ChaCha20 for x86, CRYPTOGAMS by " (Indicator: "open") "GHASH for x86, CRYPTOGAMS by " (Indicator: "open") "Montgomery Multiplication for x86, CRYPTOGAMS by " (Indicator: "open") "SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallFailed to open subkey" (Indicator: "open") "src\moduls\sendfile.rs" (Indicator: "send") "attempt to add with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\wmi-0.9.3\src\connection.rs" (Indicator: "connect") "Calling CoCreateInstance for CLSID_WbemLocator" (Indicator: "CoCreateInstance") "wmi::connection" (Indicator: "connect") "sending on a oneshot that's already sent on" (Indicator: "send") "the timeout of the request was reachedC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\minreq-2.6.0\src\connection.rs" (Indicator: "connect") "minreq::connection" (Indicator: "connect") "Establishing TCP connection to" (Indicator: "connect") "attempt to subtract with overflowrequest connection paniced" (Indicator: "connect") "server selected unoffered pskserver varied suite with early dataserver selected invalid pskResuming using PSK" (Indicator: "select") "derivedres masterexp masters ap trafficc ap traffics hs trafficc hs trafficc e trafficres binderEXPORTER_SECRETSERVER_TRAFFIC_SECRET_0CLIENT_TRAFFIC_SECRET_0SERVER_HANDSHAKE_TRAFFIC_SECRETCLIENT_HANDSHAKE_TRAFFIC_SECRETCLIENT_EARLY_TRAFFIC_SECRETC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\tls13\key_schedule.rsn" (Indicator: "bind") "server chose unusable ciphersuite for versionserver varied selected ciphersuiteUsing ciphersuite" (Indicator: "select") "server requested hrr with our groupserver requested hrr with empty cookieserver sent hrr with unhandled extensionserver send duplicate hrr extensionsserver requested hrr with no changesserver requested unsupported version in hrr@" (Indicator: "send") "attempt to add with overflowassertion failed: val > 2C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-channel-0.5.6\src\select.rs" (Indicator: "select") "failed to open ``:" (Indicator: "open")26:T4ef,"Tezis_30.09.2022.docx_____________________________________________________.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER") "Tezis_30.09.2022.docx_____________________________________________________.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "Tezis_30.09.2022.docx_____________________________________________________.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "Tezis_30.09.2022.docx_____________________________________________________.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "Tezis_30.09.2022.docx_____________________________________________________.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "Tezis_30.09.2022.docx_____________________________________________________.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")27:Ta601,Heuristic match: "Content-Length/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\partial_eq.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\option.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\into_iter.rs" Heuristic match: "attempted to zero-initialize type `std::collections::hash::map::HashMap`, which is invalid/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\traits\exact_size.rs" Heuristic match: "a Display implementation returned an error unexpectedly/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\string.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\adapters\mod.rs" Heuristic match: "src\moduls\setup.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\path.rs" Heuristic match: "assertion failed: 0 < pointee_size && pointee_size <= isize::MAX as usize/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\const_ptr.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\wmi-0.9.3\src\de\variant_de.rs" Heuristic match: "WQLC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\wmi-0.9.3\src\query.rs" Heuristic match: "#/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\copy.rs" Heuristic match: "serialize_value called before serialize_keyC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\serde_json-1.0.83\src\value\ser.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\raw_vec.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\alloc\layout.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\sync\atomic.rs" Heuristic match: "src\moduls\reqw.rs" Pattern match: "http://ip-api.com/json/?fields=status,message,country,countryCode,region,regionName,city,zip,lat,lon,timezone,isp,org,reverse,mobile,proxy,query" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\string.rs" Heuristic match: "assertion failed: 4 <= buf.len()C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\byteorder-1.4.3\src\lib.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\alloc.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\mem\maybe_uninit.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\fmt\mod.rs" Heuristic match: "0Esrc\moduls\get_info.rs" Heuristic match: "/src\moduls\downfile.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\slice.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\char\methods.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\traits\iterator.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\wmi-0.9.3\src\de\wbem_class_de.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\impls.rs" Heuristic match: "src\func\cmd_pars.rs" Heuristic match: "src\moduls\screen.rs" Heuristic match: "src\moduls\sendfile.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\obfstr-0.3.0\src\lib.rs" Heuristic match: "&src\moduls\anti_vm.rs" Heuristic match: "usernamesrc\main.rs" Heuristic match: "localhost/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\str.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\ffi\os_str.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\traits\accum.rs" Heuristic match: "attempt to add with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\screenshots-0.0.7\src\image.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\spec_from_iter_nested.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\spec_extend.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\slice\iter.rs" Heuristic match: "0CC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\screenshots-0.0.7\src\win32.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\slice\mod.rs" Heuristic match: "gAMAC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\png-0.17.5\src\common.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\png-0.17.5\src\text_metadata.rs" Heuristic match: "zTXt#/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\mod.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\writer.rs" Heuristic match: "ZeroHeightZeroWidth/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\num\mod.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\const_ptr.rs" Heuristic match: "assertion failed: step != 0/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\adapters\step_by.rs" Heuristic match: "OC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\png-0.17.5\src\common.rs" Heuristic match: "actual/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\alloc\layout.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\mod.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\png-0.17.5\src\filter.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\mem\mod.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\str\validations.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\deflate_state.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\range.rs" Heuristic match: "assertion failed: self.buffer.len() < MAX_BUFFER_LENGTHC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\output_writer.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\adapters\enumerate.rs" Heuristic match: "#/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\mod.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ops\control_flow.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\bitstream.rs" Heuristic match: "assertion failed: code.length > 0C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\encoder_state.rs" Heuristic match: "Stored block too long!C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\stored_block.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\array\mod.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\bit_reverse.rs" Heuristic match: "attempt to shift right with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\chained_hash_table.rs" Heuristic match: "Write errorC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\compress.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\huffman_table.rs" Heuristic match: "explicit panicC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\length_encode.rs" Heuristic match: "NoneC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\huffman_lengths.rs" Heuristic match: "assertion failed: self.current_end() <= BUFFER_SIZEC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\input_buffer.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\matching.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\lz77.rs" Heuristic match: "assertion failed: leaves.len() >= 2C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\length_encode.rs" Heuristic match: "assertion failed: distance > 0 && distance <= MAX_DISTANCEC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\deflate-1.0.0\src\lzvalue.rs" Heuristic match: "Literal/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\mod.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\adler32-1.2.0\src\lib.rs" Heuristic match: "assertion failed: mid <= self.len()C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\miniz_oxide-0.5.3\src\inflate\mod.rs" Heuristic match: "attempt to subtract with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\miniz_oxide-0.5.3\src\inflate\output_buffer.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\miniz_oxide-0.5.3\src\inflate\core.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ops\arith.rs" Heuristic match: "attempt to add with overflow/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\slice\iter.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\adler-1.0.2\src\algo.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crc32fast-1.3.2\src\lib.rs" Heuristic match: "9q C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crc32fast-1.3.2\src\baseline.rs" Heuristic match: "128 > 64 init128 > 64 xxassertion failed: a.len() >= 16C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crc32fast-1.3.2\src\specialized\pclmulqdq.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\stdarch\crates\std_detect\src\detect\cache.rs" Heuristic match: "BC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\display-info-0.0.8\src\win32\display_info.rs" Heuristic match: "assertion failed: !p.is_null()C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\widestring-0.5.1\src\ucstr.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\num\mod.rs" Heuristic match: "attempt to add with overflow/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\char\methods.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\sfhash-0.1.1\src\lib.rs" Heuristic match: "attempt to add with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\wmi-0.9.3\src\connection.rs" Heuristic match: "Cassertion failed: 0 < pointee_size && pointee_size <= isize::MAX as usize/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\const_ptr.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\wmi-0.9.3\src\variant.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\traits\exact_size.rs" Heuristic match: "wmi::result_enumeratorC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\wmi-0.9.3\src\result_enumerator.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\wmi-0.9.3\src\safearray.rs" Heuristic match: "attempt to add with overflow/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\alloc\layout.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\in_place_collect.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\widestring-0.5.1\src\ucstr.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\num\dec2flt\common.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\num\dec2flt\number.rs" Heuristic match: "!$'+.158;/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\num\dec2flt\slow.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\single-instance-0.3.3\src\lib.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\widestring-0.4.3\src\ucstring.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\lazy_static-1.4.0\src\inline_lazy.rs" Pattern match: "http://213.109.192.231:9942/bot_auth213.202.216.211:80" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\sync\once.rs" Heuristic match: "called `Option::unwrap()` on a `None` value/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\alloc\layout.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\mod.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\buffered\bufwriter.rs" Heuristic match: "assertion failed: (*tail).value.is_none()/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\sync\mpsc\mpsc_queue.rs" Heuristic match: "C:\Users\runneradmin\.cargo\registry\src\github.com-1285ae84e5963aae\hashbrown-0.12.3\src\raw\mod.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\sys\windows\io.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\minreq-2.6.0\src\response.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\thread\mod.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\sync\mpsc\sync.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\minreq-2.6.0\src\request.rs" Pattern match: "https:///#/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\mod.rs" Heuristic match: "description() is deprecated; use Display/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\mem\mod.rs" Heuristic match: "internal error: entered unreachable code/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\sync\mpsc\oneshot.rs" Heuristic match: "assertion failed: n <= self.initialized/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\readbuf.rs" Heuristic match: "internal error: entered unreachable code/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\sync\mpsc\mod.rs" Heuristic match: "NoneC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\stream.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\buffered\bufreader.rs" Heuristic match: "assertion failed: ptr != EMPTY/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\sync\mpsc\shared.rs" Pattern match: "https://github.com/rust-lang/rust/issues/39364" Heuristic match: "assertion failed: ptr != EMPTY/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\sync\mpsc\stream.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\str\pattern.rs" Heuristic match: "the timeout of the request was reachedC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\minreq-2.6.0\src\connection.rs" Heuristic match: "attempt to subtract with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\punycode-0.4.1\src\lib.rs" Heuristic match: "attempt to add with overflow/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\raw_vec.rs" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "0www.entrust.net/CPS" Pattern match: "www.digicert.com1+0" Pattern match: "https://www.catcert.net/verarrel" Pattern match: "www.xrampsecurity.com1$0" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\digest.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\msgs\message.rs" Heuristic match: "sessionkx-hintC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\msgs\persist.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\conn.rs" Heuristic match: "assertion failed: buf.len() <= c::ULONG::MAX as usize/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\sys\windows\io.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\msgs\base.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\tls13\key_schedule.rs" Heuristic match: "assertion failed: mid <= self.len()/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\vec_deque\ring_slices.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\client\tls13.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\partial_eq.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\msgs\handshake.rs" Heuristic match: "cannot access a Thread Local Storage value during or after destruction/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\thread\local.rs" Heuristic match: "PoisonErrorC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\digest.rs" Heuristic match: "assertion failed: self.used <= OpaqueMessage::MAX_WIRE_SIZEC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\msgs\deframer.rs" Heuristic match: "attempt to subtract with overflowextended master secretmaster secretC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\tls12\mod.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\verify.rs" Heuristic match: "rustls::client::commonC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\client\common.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\slice\index.rs" Heuristic match: "attempt to join into collection with len > usize::MAX/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\str.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\vecbuf.rs" Heuristic match: "assertion failed: size > 0C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\client\handy.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\cipher.rs" Heuristic match: "rustls::checkC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\check.rs" Heuristic match: "attempt to divide by zero/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\traits\iterator.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\msgs\hsjoiner.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\tls12\prf.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\tls13\mod.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\ticketer.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\client\client_conn.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\aead.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\hkdf.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\str.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\msgs\fragmenter.rs" Heuristic match: "assertion failed: self.encrypt_state == DirectionState::PreparedC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\record_layer.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\bs_debug.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\client\tls12.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\msgs\codec.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rustls-0.20.6\src\client\hs.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\sct-0.7.0\src\lib.rs" Heuristic match: "UnknownLogUnsupportedSctVersionTimestampInFutureInvalidSignatureMalformedSct/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\adapters\enumerate.rs" Heuristic match: "attempt to add with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\untrusted-0.7.1\src/untrusted.rs" Heuristic match: "attempt to add with overflow/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\alloc.rs" Heuristic match: "called `Option::unwrap()` on a `None` valueC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\webpki-0.22.0\src\name\dns_name.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\webpki-0.22.0\src\end_entity.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\webpki-0.22.0\src\signed_data.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\webpki-0.22.0\src\name\ip_address.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\webpki-0.22.0\src\cert.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\untrusted-0.7.1\src/untrusted.rs" Heuristic match: "attempt to add with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\webpki-0.22.0\src\der.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\io\der.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\webpki-0.22.0\src\name\verify.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\webpki-0.22.0\src\verify_cert.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\aead\aes.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\cpu.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\hmac.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\rsa.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\rsa\verification.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\aead\shift.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\digest\sha2.rs" Heuristic match: "attempt to add with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\digest.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\curve25519\ed25519\verification.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b\ops.rs" Heuristic match: "attempt to subtract with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\io\der.rs" Heuristic match: "assertion failed: !input.is_empty()C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\io\positive.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\curve25519\scalar.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b\ecdsa\digest_scalar.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b\ops\p256.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b\ops\p384.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b\private_key.rs" Heuristic match: "InvalidComponentInvalidEncodingTooSmallTooLargeUnexpectedErrorUnspecified/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\adapters\enumerate.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\aead\chacha.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\curve25519\x25519.rs" Heuristic match: "assertion failed: digest_alg.block_len >= digest_alg.output_lenC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\hkdf.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\rand.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\aead\chacha20_poly1305.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\bits.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b\curve.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\aead\counter.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b\ecdsa\verification.rs" Heuristic match: "Once has panickedC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\spin-0.5.2\src\once.rs" Heuristic match: "attempt to add with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b\public_key.rs" Heuristic match: "attempt to divide by zero/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\char\methods.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\aead\aes_gcm.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\aead\block.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\agreement.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\suite_b\ecdh.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\endian.rs" Heuristic match: "attempt to multiply with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\limb.rs" Heuristic match: "assertion failed: core::mem::size_of::() >= core::mem::size_of::()C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\rand.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\bssl.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\ec\keys.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\rsa\padding.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ring-0.16.20\src\arithmetic\bigint.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\serde_json-1.0.83\src\read.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\serde_json-1.0.83\src\value\de.rs" Heuristic match: "fmt errorcalled `Option::unwrap()` on a `None` value/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\alloc.rs" Heuristic match: "assertion failed: n <= self.bytes.len()C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ryu-1.0.11\src\buffer\mod.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\serde_json-1.0.83\src\de.rs" Heuristic match: "alserueull/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\alloc\layout.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\boxed.rs" Heuristic match: "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5" Heuristic match: "attempt to add with overflow/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "internal error: entered unreachable codeC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\serde_json-1.0.83\src\ser.rs" Heuristic match: "assertion failed: idx < CAPACITY/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\btree\node.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ryu-1.0.11\src\pretty\mod.rs" Heuristic match: "assertion failed: v < 100000000000000000C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ryu-1.0.11\src\d2s.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ryu-1.0.11\src\pretty\mantissa.rs" Heuristic match: "attempt to add with overflowC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\ryu-1.0.11\src\pretty\exponent.rs" Heuristic match: "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: value != 0C:\Users\Admin\.cargo\regist" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\winreg-0.10.1\src\lib.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\mod.rs" Heuristic match: "Bassertion failed: 0 < pointee_size && pointee_size <= isize::MAX as usize/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\const_ptr.rs" Heuristic match: "assertion failed: mid <= self.len()SystemC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\sysinfo-0.24.7\src\windows\process.rs" Heuristic match: "global_key_idle disappearedC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\sysinfo-0.24.7\src\windows\system.rs" Heuristic match: "C/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\num\mod.rs" Heuristic match: "attempt to add with overflowassertion failed: 0 < pointee_size && pointee_size <= isize::MAX as usize/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\const_ptr.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\sysinfo-0.24.7\src\windows\utils.rs" Heuristic match: "too many values pushed to consumerC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-1.5.3\src\iter\collect\consumer.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-1.5.3\src\math.rs" Heuristic match: "internal error: entered unreachable codeC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-core-1.9.3\src\job.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-core-1.9.3\src\log.rs" Heuristic match: "assertion failed: WorkerThread::current().is_null()C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-core-1.9.3\src\registry.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\sysinfo-0.24.7\src\windows\disk.rs" Heuristic match: "attempt to subtract with overflow/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\str\validations.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "called `Option::unwrap()` on a `None` valueassertion failed: job_b.latch.probe()C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-core-1.9.3\src\join\mod.rs" Heuristic match: "attempt to add with overflow/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\traits\accum.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-1.5.3\src\iter\plumbing\mod.rs" Heuristic match: "attempt to subtract with overflow/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\ffi\os_str.rs" Heuristic match: "attempt to divide by zeroC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-core-1.9.3\src\sleep\counters.rs" Heuristic match: "attempt to subtract with overflowassertion failed: 0 < pointee_size && pointee_size <= isize::MAX as usize/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\const_ptr.rs" Heuristic match: "assertion failed: BorrowType::PERMITS_TRAVERSAL/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\btree\node.rs" Heuristic match: "Included/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\into_iter.rs" Heuristic match: "attempted to zero-initialize type `windows::process::Process`, which is invalid/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\char\methods.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-1.5.3\src\vec.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-1.5.3\src\iter\collect\mod.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\sysinfo-0.24.7\src\windows\network.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\sysinfo-0.24.7\src\windows\tools.rs" Heuristic match: "assertion failed: mid <= self.len()/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\traits\exact_size.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-utils-0.8.11\src\atomic\atomic_cell.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-channel-0.5.6\src\flavors\zero.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-channel-0.5.6\src\waker.rs" Heuristic match: "assertion failed: n_threads <= THREADS_MAXC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-core-1.9.3\src\sleep\mod.rs" Heuristic match: "attempt to add with overflowassertion failed: val > 2C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-channel-0.5.6\src\select.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-channel-0.5.6\src\flavors\array.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-core-1.9.3\src\registry.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-core-1.9.3\src\sleep\counters.rs" Heuristic match: "converting zero into `Owned`C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-epoch-0.9.10\src\atomic.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-channel-0.5.6\src\context.rs" Heuristic match: "ThreadIdleThreadTerminateThreadStartterminate_addrFlushTerminatedSleepingNotifiedIdleWorking/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\mod.rs" Heuristic match: "assertion failed: mid <= self.len()/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\alloc.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\vec_deque\ring_slices.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-deque-0.8.2\src\deque.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-epoch-0.9.10\src\internal.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-utils-0.8.11\src\backoff.rs" Heuristic match: "internal error: entered unreachable codeC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-channel-0.5.6\src\channel.rs" Heuristic match: "PoisonErrorSendError(..)/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\in_place_collect.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\rayon-core-1.9.3\src\latch.rs" Heuristic match: "GlobalPoolAlreadyInitialized/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\raw_vec.rs" Heuristic match: "internal error: entered unreachable codeC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-channel-0.5.6\src\flavors\at.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-channel-0.5.6\src\flavors\list.rs" Heuristic match: "failed to spawn thread/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\thread\mod.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-epoch-0.9.10\src\default.rs" Heuristic match: "Lazy instance has previously been poisonedC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\once_cell-1.13.0\src\lib.rs" Heuristic match: "assertion failed: self.is_initialized()C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\once_cell-1.13.0\src\imp_std.rs" Heuristic match: "assertion failed: falseC:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\once_cell-1.13.0\src\lib.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-epoch-0.9.10\src\sync\list.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\crossbeam-epoch-0.9.10\src\atomic.rs" Heuristic match: "attempt to divide by zeroassertion failed: step != 0/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\iter\adapters\step_by.rs" Heuristic match: "C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\once_cell-1.13.0\src\imp_std.rs" Heuristic match: "()/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\string.rs" Heuristic match: "already borrowed/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\char\methods.rs" Heuristic match: "library\std\src\rt.rs" Heuristic match: "library\std\src\thread\scoped.rs" Heuristic match: "library\std\src\thread\mod.rs" Heuristic match: "library\std\src\io\buffered\bufwriter.rs" Heuristic match: "library\std\src\io\buffered\linewritershim.rs" Heuristic match: "library\std\src\io\readbuf.rs" Heuristic match: "library\std\src\io\stdio.rs" Heuristic match: "stdoutstderrlibrary\std\src\io\mod.rs" Heuristic match: "library\std\src\net\ip.rs" Heuristic match: "library\std\src\net\parser.rs" Heuristic match: "library\std\src\path.rs" Heuristic match: "library\std\src\process.rs" Heuristic match: "library\std\src\sync\mpsc\sync.rs" Heuristic match: "library\std\src\sync\once.rs" Heuristic match: "overflow when adding duration to instantlibrary\std\src\time.rs" Heuristic match: "PATHlock count overflow in reentrant mutexlibrary\std\src\sys_common\remutex.rs" Heuristic match: "RUST_MIN_STACKlibrary\std\src\sys_common\thread_info.rs" Heuristic match: "library\std\src\sys_common\wtf8.rs" Heuristic match: "library\std\src\sys_common\mod.rs" Heuristic match: "library\std\src\alloc.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "library\std\src\sys\windows\io.rs" Heuristic match: "library\std\src\sys\windows\net.rs" Heuristic match: "library\std\src\sys\windows\os.rs" Heuristic match: "library\std\src\sys\windows\path.rs" Heuristic match: "library\std\src\sys\windows\pipe.rs" Heuristic match: "library\std\src\sys\windows\process.rs" Heuristic match: "exeNUL\cmd.execouldn't generate random bytes with fallback RNGlibrary\std\src\sys\windows\rand.rs" Heuristic match: "library\std\src\sys\windows\thread.rs" Heuristic match: "assertion failed: key != c::TLS_OUT_OF_INDEXESlibrary\std\src\sys\windows\thread_local_key.rs" Heuristic match: "library\std\src\sys\windows\time.rs" Heuristic match: "library\std\src\sys\windows\mod.rs" Heuristic match: "library\std\src\sys\windows\stack_overflow.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\dbghelp.rs" Heuristic match: "called `Option::unwrap()` on a `None` valuelibrary\panic_unwind\src\seh.rs" Heuristic match: "C:\Users\runneradmin\.cargo\registry\src\github.com-1285ae84e5963aae\rustc-demangle-0.1.21\src\legacy.rs" Heuristic match: "C:\Users\runneradmin\.cargo\registry\src\github.com-1285ae84e5963aae\rustc-demangle-0.1.21\src\v0.rs" Heuristic match: ".llvm.C:\Users\runneradmin\.cargo\registry\src\github.com-1285ae84e5963aae\rustc-demangle-0.1.21\src\lib.rs" Heuristic match: "library\alloc\src\ffi\c_str.rs" Heuristic match: "a formatting trait implementation returned an errorlibrary\alloc\src\fmt.rs" Heuristic match: "library\alloc\src\str.rs" Heuristic match: "AClibrary\core\src\num\dec2flt\decimal.rs" Heuristic match: "library\core\src\num\dec2flt\lemire.rs" Heuristic match: "assertion failed: edelta >= 0library\core\src\num\diy_float.rs" Heuristic match: "library\core\src\num\flt2dec\strategy\grisu.rs" Heuristic match: "library\core\src\num\flt2dec\mod.rs" Heuristic match: "library\core\src\num\mod.rs" Heuristic match: "library\core\src\panicking.rs" Heuristic match: "library\core\src\slice\index.rs" Heuristic match: "library\core\src\str\pattern.rs" Heuristic match: "library\core\src\unicode\printable.rs" Heuristic match: "library\core\src\unicode\unicode_data.rs" Heuristic match: "library\core\src\num\bignum.rs"28:T40b,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]29:T508,"C:\Users\Admin\.cargo\registry\src\github.com-1285ae84e5963aae\whoami-1.2.1\src\windows.rsassertion failed: fail" (Indicator: "whoami") "Illegal SNI hostname received" (Indicator: "hostname") "UnknownHostName" (Indicator: "hostname") "ordMacUnexpectedMessageCloseNotifyTransportParametersDraftRenegotiationInfoChannelIdNextProtocolNegotiationTransportParametersKeyShareSignatureAlgorithmsCertPostHandshakeAuthOIDFiltersCertificateAuthoritiesTicketEarlyDataInfoPSKKeyExchangeModesCookieSupportedVersionsEarlyDataPreSharedKeySessionTicketExtendedMasterSecretPaddingSCTALProtocolNegotiationUseSRTPSignatureAlgorithmsSRPECPointFormatsEllipticCurvesCertificateTypeServerAuthzClientAuthzUserMappingStatusRequestTruncatedHMACTrustedCAKeysClientCertificateUrlMaxFragmentLengthServerNameHostNameX448X25519secp521r1secp384r1secp256r1FFDHE8192FFDHE6144FFDHE4096FFDHE3072FFDHE2048SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHASSL_RSA_FIPS_WITH_DES_CBC_SHATLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256TLS_PSK_WITH_CHACHA20_POLY1305_SHA256TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8TLS" (Indicator: "hostname")2a:T5a2,"Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\pdh.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\netapi32.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\netutils.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\SAMCLI.DLL" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\iphlpapi.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\RpcRtRemote.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\Windows\system32\wbem\NTDSAPI.dll" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "Tezis_30.09.2022.docx.exe" trying to access non-existent file "C:\API-MS-WIN-CORE-SYNCH-L1-2-0.DLL"2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790311907273,"unified_at":"2026-09-25T04:51:47.273Z","metadata":{"hashes":{"sha256":"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605","sha1":"f918e5f50bb3b73a732bc9cb3595bff2ea7b761f","md5":"8674100d43231294b6562717a9ab3a07","sha512":"21d09dfee3cb19432e8c5ceb6efa381538c0be4a9832e87a41be98d6c50fce895cbeada026f9b91e7d93b98ece77e8f5405f794706a4c0582791d5d770066a1d","ssdeep":"49152:cwRfTVhqLYdSO//XzoDB/1x0FKIrQyjzxTeIU6ihd:558LcroDt6bV+","ssdeep_chunks":["49152:cwRfTVh","49152:wRfTVhq","49152:RfTVhqL","49152:fTVhqLY","49152:TVhqLYd","49152:VhqLYdS","49152:hqLYdSO","49152:qLYdSO/","49152:LYdSO//","49152:YdSO//X","49152:dSO//Xz","49152:SO//Xzo","49152:O//XzoD","49152://XzoDB","49152:/XzoDB/","49152:XzoDB/1","49152:zoDB/1x","49152:oDB/1x0","49152:DB/1x0F","49152:B/1x0FK","49152:/1x0FKI","49152:1x0FKIr","49152:x0FKIrQ","49152:0FKIrQy","49152:FKIrQyj","49152:KIrQyjz","49152:IrQyjzx","49152:rQyjzxT","49152:QyjzxTe","49152:yjzxTeI","49152:jzxTeIU","49152:zxTeIU6","49152:xTeIU6i","49152:TeIU6ih","49152:eIU6ihd","98304:cwRfTVh","98304:wRfTVhq","98304:RfTVhqL","98304:fTVhqLY","98304:TVhqLYd","98304:VhqLYdS","98304:hqLYdSO","98304:qLYdSO/","98304:LYdSO//","98304:YdSO//X","98304:dSO//Xz","98304:SO//Xzo","98304:O//XzoD","98304://XzoDB","98304:/XzoDB/","98304:XzoDB/1","98304:zoDB/1x","98304:oDB/1x0","98304:DB/1x0F","98304:B/1x0FK","98304:/1x0FKI","98304:1x0FKIr","98304:x0FKIrQ","98304:0FKIrQy","98304:FKIrQyj","98304:KIrQyjz","98304:IrQyjzx","98304:rQyjzxT","98304:QyjzxTe","98304:yjzxTeI","98304:jzxTeIU","98304:zxTeIU6","98304:xTeIU6i","98304:TeIU6ih","98304:eIU6ihd","49152:558Lcro","49152:58LcroD","49152:8LcroDt","49152:LcroDt6","49152:croDt6b","49152:roDt6bV","49152:oDt6bV+"],"imphash":"a8022619d5b6ddbb4e0a6338c92bd13c"},"file_info":{"file_name":"Tezis_30.09.2022.docx.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4612608,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1664534887000,"last_seen":1688613203000,"last_multi_scan":1688613203000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":26,"suspicious_count":15,"malicious_count":4,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Frs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Dropper]/Win32.Dapato","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.jxhmv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.440039","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.440039 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Agent.VES trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005990761 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Dapato.rcbd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.9C2019CD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.9C2019CD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.BHKE-6021","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.QFK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3411241","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TROJ_FR.9C2019CD","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the name of the user associated with the current thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"malicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"suspicious","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" issued a query \"SELECT * FROM Win32_CacheMemory\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Downloads\\New folder\\jlo_ (2)\\jlo-client_sync\\target\\debug\\deps\\jlo.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UninstallFailed to open subkey\"\n \"attempt to multiply with overflowSOFTWARE\\Microsoft\\Windows NT\\CurrentVersionProductName Process\"\n \"SOFTWARE\\Wow6432Node\\Microsoft\\VisualStudio\\14.0\\Setup\\VC\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$25","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$26","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin\" file has an entrypoint instructions - \"call0x7a45ca,jmp0x7a3d15,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,pushebx,pushesi,moveax, dword ptr [esp + 0x18],oreax, eax,jne0x7a3ed2,movecx, dword ptr [esp + 0x14],moveax, dword ptr [esp + 0x10],xoredx, edx,divecx,movebx, eax,moveax, dword ptr [esp + 0xc],divecx,movedx, ebx,jmp0x7a3f13,movecx, eax,movebx, dword ptr [esp + 0x14],movedx, dword ptr [esp + 0x10],moveax, dword ptr [esp + 0xc],shrecx, 1,rcrebx, 1,shredx, 1,rcreax, 1,orecx, ecx,jne0x7a3ee0,divebx,movesi, eax,muldword ptr [esp + 0x18],movecx, eax,moveax, dword ptr [esp + 0x14],\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin\" (Offset: 4073246)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Observed api string:\"NetUserGetLocalGroups which can Retrieves a list of local groups to which a specified user belongs\"[Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]\n Observed api string:\"NetUserEnum which can Retrieves information about all user accounts on a server\"[Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetUserEnum\" which can \"Retrieves information about all user accounts on a server.\" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]\n Observed import api \"NetUserGetLocalGroups\" which can \"Retrieves a list of local groups to which a specified user belongs.\" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"was redirected to an absolute url with an invalid protocolhttp://https:///#/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\\library\\std\\src\\io\\mod.rs\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed api string:\"GetDriveTypeW\" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindNextFileW\" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]\n Observed api string:\"FindFirstFileW\" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariableW\" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the name of the user associated with the current thread (API string)","description":"Observed api string:\"GetUserNameW\" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed api string:\"CreateCompatibleBitmap\" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UninstallFailed to open subkey\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetEnvironmentVariable API","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-81","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed api string:\"AllocateAndInitializeSid which can Allocates and initializes a security identifier (SID) with up to eight subauthorities\"[Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]\n Observed api string:\"AllocateAndInitializeSid which can Initializes a security identifier (SID)\"[Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]\n Observed api string:\"CheckTokenMembership which can Determines whether a specified security identifier (SID) is enabled in an access token\"[Source: 296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$28","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"assertion failed: key != c::TLS_OUT_OF_INDEXESlibrary\\std\\src\\sys\\windows\\thread_local_key.rs\" (Indicator: \"exes\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" at 00000000-00002448-00000033-2425250","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"dbghelp.dll\" (Indicator: \"dbghelp.dll\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" issued a query \"SELECT * FROM Win32_CacheMemory\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM MSAcpi_ThermalZoneTemperature\" (Indicator: \"msacpi_thermalzonetemperature\"; File: \"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/70 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"213.109.192.231\" found in string \"http://213.109.192.231:9942/bot_auth213.202.216.211:80\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeW\n GetFileAttributesW\n UnhandledExceptionFilter\n GetLogicalDrives\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n CreateThread\n GetSystemDirectoryW\n TerminateProcess\n SleepEx\n LoadLibraryA\n OpenProcess\n DeleteFileW\n GetProcAddress\n GetSystemInfo\n FindNextFileW\n GetComputerNameExW\n FindFirstFileW\n CreateFileW\n SleepConditionVariableSRW\n CopyFileExW\n GetTickCount64\n GetModuleHandleA\n WriteFileEx\n GetModuleHandleW\n CreateProcessW\n Sleep\n GetModuleFileNameExW\n RegCreateKeyExW\n RegCloseKey\n OpenProcessToken\n GetUserNameW\n RegEnumKeyExW\n RegOpenKeyExW\n recv\n send\n WSASend\n WSAStartup\n WSASocketW\n closesocket\n connect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" wrote bytes \"c0df5c771cf95b77ccf85b770d645d7700000000c011d17600000000fc3ed17600000000e013d176000000009457ed7425e05c77c6e05c7700000000bc6aec7400000000cf31d176000000009319ed74000000002c32d17600000000\" to virtual address \"0x75171000\" (part of module \"NSI.DLL\")\n \"Tezis_30.09.2022.docx_____________________________________________________.exe\" wrote bytes \"711109027a3b0802ab8b02007f950200fc8c0200729602006cc805001ecd05027d260502\" to virtual address \"0x755907E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"Tezis_30.09.2022.docx_____________________________________________________.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Tezis_30.09.2022.docx_____________________________________________________.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Tezis_30.09.2022.docx_____________________________________________________.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Tezis_30.09.2022.docx_____________________________________________________.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"Tezis_30.09.2022.docx_____________________________________________________.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin\" (Offset: 4309032)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"http://ip-api.com/json/?fields=status,message,country,countryCode,region,regionName,city,zip,lat,lon,timezone,isp,org,reverse,mobile,proxy,query\" (Indicator: \"ip-api.com\"; File: \"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$29","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$2a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"29/71 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"},{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive","windows-server-utility"],"sandbox_reports":[{"id":"63650875e60bd2597e200365","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"Tezis_30.09.2022.docx.exe","analysis_start_time":"2022-11-04T12:41:27+00:00","indicators_count":{"informative":26,"suspicious":18,"malicious":4},"is_in_unified_schema":true},{"id":"6336c9664cd69a00be7ef4fc","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":53,"malware_family":"Malware.Generic","submit_name":"Tezis_30.09.2022.docx_____________________________________________________.exe","analysis_start_time":"2022-09-30T10:48:09+00:00","indicators_count":{"informative":26,"suspicious":18,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"}],"processes":[{"pid":2448,"ppid":0,"name":"Tezis_30.09.2022.docx_____________________________________________________.exe","command_line":"","sha256":"296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605","normalized_path":"C:\\Tezis_30.09.2022.docx_____________________________________________________.exe","uid":"00000000-00002448","icon":"$2b"}],"all_imported_dlls":["nsi.dll","setupapi.dll","ole32.dll","cfgmgr32.dll","wkscli.dll","api-ms-win-core-processthreads-l1-1-1.dll","netutils.dll","api-ms-win-core-localization-l1-2-0.dll","fastprox.dll","devobj.dll","IPHLPAPI.DLL","wbemsvc.dll","lpk.dll","api-ms-win-crt-runtime-l1-1-0.dll","msctf.dll","wow64cpu.dll","user32.dll","secur32.dll","rpcrt4.dll","cryptbase.dll","netapi32.dll","ucrtbase.dll","shell32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","fltLib.dll","bcrypt.dll","api-ms-win-crt-stdio-l1-1-0.dll","wow64.dll","sspicli.dll","shlwapi.dll","ws2_32.dll","vcruntime140.dll","api-ms-win-crt-convert-l1-1-0.dll","advapi32.dll","winnsi.dll","psapi.dll","api-ms-win-crt-heap-l1-1-0.dll","oleaut32.dll","kernel32.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","imm32.dll","wbemcomn.dll","gdi32.dll","srvcli.dll","wbemprox.dll","wow64win.dll","sechost.dll","usp10.dll","api-ms-win-core-file-l2-1-0.dll","RpcRtRemote.dll","powrprof.dll","samcli.dll","api-ms-win-crt-locale-l1-1-0.dll","cryptsp.dll","rsaenh.dll","KernelBase.dll","msvcrt.dll","pdh.dll","api-ms-win-core-synch-l1-2-0.dll","ntdsapi.dll","clbcatq.dll","ntdll.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6336c9664cd69a00be7ef4fc"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"63650875e60bd2597e200365"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["63650875e60bd2597e200365","6336c9664cd69a00be7ef4fc"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious TROJ_FR.9C2019CD Sample 296599df29f4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 296599df29f4…. Malware family: TROJ_FR.9C2019CD. Threat score 100/100. 16/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605"}],["$","meta","4",{"property":"og:title","content":"Malicious TROJ_FR.9C2019CD Sample 296599df29f4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 296599df29f4…. Malware family: TROJ_FR.9C2019CD. Threat score 100/100. 16/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/296599df29f4ffa9bf753ff9440032d912969d0bab6e3208ab88b350f9a83605"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TROJ_FR.9C2019CD Sample 296599df29f4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 296599df29f4…. Malware family: TROJ_FR.9C2019CD. Threat score 100/100. 16/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]