24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/HackTool.RustRegion Sample 40e7e77aff60… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 40e7e77aff60…. Malware family: Win64/HackTool.RustRegion. Threat score 100/100. 10/28 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d","keywords":["Malicious","Win64/HackTool.RustRegion","malware analysis","sandbox report","threat intelligence","40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d"],"about":{"@type":"SoftwareApplication","name":"bounty-46590787913654976","applicationCategory":["peexe","64bits","executable"],"identifier":"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/HackTool.RustRegion","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":1,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T443,Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\compression-core-0.4.29\src\util.rs" (Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\async-compression-0.4.32\src\tokio\bufread\generic\decoder.rs" (Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\compression-codecs-0.4.31\src\gzip\header.rs" (Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\compression-codecs-0.4.31\src\gzip\decoder.rs" (Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found string "amount of bytes read does not matchCRC computed does not matchInvalid gzip footer lengthInvalid gzip headerNonedeflate decompression errorrequires a dictionarydeflate decompression error:" (Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp")26:Tae1,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp")27:T458,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp")28:Tb2b,"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C")29:Te60,Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertDuplicateStore" (Indicator: "CertDuplicateStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertDuplicateCertificateChain" (Indicator: "CertDuplicateCertificateChain"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00003860.00000000.84916.20FC0000.00000004.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertDuplicateStore" (Indicator: "CertDuplicateStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertDuplicateCertificateChain" (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp")2a:T259d,Assembly shows XOR instruction xor ecx 5Ch in Stream UID: 16137-6355-00000001403F5120 Assembly shows XOR instruction xor eax 5Ch in Stream UID: 16137-6355-00000001403F5120 Assembly shows XOR instruction xor r8L 01h in Stream UID: 16137-6385-00000001403E57B0 Assembly shows XOR instruction xor al 01h in Stream UID: 16137-6385-00000001403E57B0 Assembly shows XOR instruction xor al 01h in Stream UID: 16137-6387-00000001403E5320 Assembly shows XOR instruction xor r8d ecx in Stream UID: 16137-6477-00000001403D4E40 Assembly shows XOR instruction xor eax ecx in Stream UID: 16137-6477-00000001403D4E40 Assembly shows XOR instruction xor ecx r8d in Stream UID: 16137-6477-00000001403D4E40 Assembly shows XOR instruction xor ecx eax in Stream UID: 16137-6477-00000001403D4E40 Assembly shows XOR instruction xor r9d ecx in Stream UID: 16137-6477-00000001403D4E40 Assembly shows XOR instruction xor bpl 01h in Stream UID: 16137-6480-00000001403D4370 Assembly shows XOR instruction xor ch 01h in Stream UID: 16137-6480-00000001403D4370 Assembly shows XOR instruction xor al 01h in Stream UID: 16137-6480-00000001403D4370 Assembly shows XOR instruction xor bpl 01h in Stream UID: 16137-6487-00000001403D3B60 Assembly shows XOR instruction xor ch 01h in Stream UID: 16137-6487-00000001403D3B60 Assembly shows XOR instruction xor al 01h in Stream UID: 16137-6487-00000001403D3B60 Assembly shows XOR instruction xor edx 3B9ACA00h in Stream UID: 16137-6940-0000000140381550 Assembly shows XOR instruction xor r8d 3B9ACA00h in Stream UID: 16137-6940-0000000140381550 Assembly shows XOR instruction xor eax 3B9ACA00h in Stream UID: 16137-6940-0000000140381550 Assembly shows XOR instruction pxor xmm4 xmm2 in Stream UID: 16137-8349-0000000140239740 Assembly shows XOR instruction xor cl 5Ah in Stream UID: 16137-8349-0000000140239740 Assembly shows XOR instruction xor edi eax in Stream UID: 16137-8349-0000000140239740 Assembly shows XOR instruction xor eax ebp in Stream UID: 16137-8349-0000000140239740 Assembly shows XOR instruction xor al 75h in Stream UID: 16137-8349-0000000140239740 Assembly shows XOR instruction xor al CAh in Stream UID: 16137-8349-0000000140239740 Assembly shows XOR instruction pxor xmm3 xmm1 in Stream UID: 16137-8450-000000014021F030 Assembly shows XOR instruction pxor xmm4 xmm1 in Stream UID: 16137-8450-000000014021F030 Assembly shows XOR instruction pxor xmm4 xmm2 in Stream UID: 16137-8450-000000014021F030 Assembly shows XOR instruction xor r8L 5Ah in Stream UID: 16137-8450-000000014021F030 Assembly shows XOR instruction xor al 5Ah in Stream UID: 16137-8450-000000014021F030 Assembly shows XOR instruction pxor xmm3 xmm1 in Stream UID: 16137-9859-0000000140017390 Assembly shows XOR instruction pxor xmm4 xmm1 in Stream UID: 16137-9859-0000000140017390 Assembly shows XOR instruction xor r8L 5Ah in Stream UID: 16137-9859-0000000140017390 Assembly shows XOR instruction xor al 5Ah in Stream UID: 16137-9859-0000000140017390 Assembly shows XOR instruction pxor xmm3 xmm1 in Stream UID: 16137-10820-000000014003EE5B Assembly shows XOR instruction pxor xmm4 xmm1 in Stream UID: 16137-10820-000000014003EE5B Assembly shows XOR instruction pxor xmm4 xmm2 in Stream UID: 16137-10820-000000014003EE5B Assembly shows XOR instruction xor cl 5Ah in Stream UID: 16137-10820-000000014003EE5B Assembly shows XOR instruction xor r9L byte ptr [rbp+rdx+00h] in Stream UID: 16137-11016-000000014004CDA3 Assembly shows XOR instruction xor cl byte ptr [rbp+rdx+00h] in Stream UID: 16137-11016-000000014004CDA3 Assembly shows XOR instruction xor r8L byte ptr [rbp+rdx+00h] in Stream UID: 16137-11016-000000014004CDA3 Assembly shows XOR instruction xor al byte ptr [rbp+rdx+00h] in Stream UID: 16137-11016-000000014004CDA3 Assembly shows XOR instruction pxor xmm3 xmm1 in Stream UID: 16137-18707-000000014021EBBB Assembly shows XOR instruction pxor xmm4 xmm1 in Stream UID: 16137-18707-000000014021EBBB Assembly shows XOR instruction xor r8L 5Ah in Stream UID: 16137-18707-000000014021EBBB Assembly shows XOR instruction xor al 5Ah in Stream UID: 16137-18707-000000014021EBBB Assembly shows XOR instruction xor bl 3Dh in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor eax ecx in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor eax 5B6735DCh in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor rcx rdx in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor ecx edx in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor bl 8Dh in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor sil 72h in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor dh 72h in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor rax rcx in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction pxor xmm3 xmm1 in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction pxor xmm4 xmm1 in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor dl 5Ah in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor r9L byte ptr [r13+rdx+00h] in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor cl byte ptr [rbp+rdx+00h] in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor r8L byte ptr [r13+rdx+00h] in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor al byte ptr [rbp+rdx+00h] in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor r12 05h in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor esp 05h in Stream UID: 16137-18711-000000014021F298 Assembly shows XOR instruction xor byte ptr [rdx+rcx+48h] dh in Stream UID: 16137-18742-0000000140221C46 Assembly shows XOR instruction xor edx edi in Stream UID: 16137-18742-0000000140221C46 Assembly shows XOR instruction xor byte ptr [rdi] cl in Stream UID: 16137-18742-0000000140221C46 Assembly shows XOR instruction xor bl 44h in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor dil 5Fh in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor bh 5Fh in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor byte ptr [rbp+0Bh] dh in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor al 26h in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor al 54h in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor al D0h in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor rcx rdx in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor ecx edx in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor rdx r8 in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor edx eax in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor r11 r10 in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor ebx edx in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor r10d 1AE9FB97h in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor edx 1AE9FB97h in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor al 1Ah in Stream UID: 16137-19004-000000014023035A Assembly shows XOR instruction xor rcx r8 in Stream UID: 16137-21074-00000001402BE3B9 Assembly shows XOR instruction xor ecx eax in Stream UID: 16137-21074-00000001402BE3B9 Assembly shows XOR instruction xor bpl 01h in Stream UID: 16137-22540-000000014034DC60 Assembly shows XOR instruction xor ch 01h in Stream UID: 16137-22540-000000014034DC60 Assembly shows XOR instruction xor byte ptr [rax-39h] cl in Stream UID: 16137-24273-00000001403C71DD Assembly shows XOR instruction xor dil 01h in Stream UID: 16137-24776-00000001403F61D6 Assembly shows XOR instruction xor eax dword ptr [rax] in Stream UID: 16137-24803-00000001403F8BAC Assembly shows XOR instruction xor rcx qword ptr [r8+06h] in Stream UID: 16137-24803-00000001403F8BAC Assembly shows XOR instruction xor ecx dword ptr [rax+06h] in Stream UID: 16137-24803-00000001403F8BAC Assembly shows XOR instruction xor al 01h in Stream UID: 16137-24803-00000001403F8BAC Assembly shows XOR instruction xor rcx rsp in Stream UID: 16137-25073-0000000140419654 Assembly shows XOR instruction xor ecx esp in Stream UID: 16137-25073-0000000140419654 Assembly shows XOR instruction xor edi dword ptr [rcx] in Stream UID: 16137-25281-000000014042630D Assembly shows XOR instruction xor dword ptr [rcx] edi in Stream UID: 16137-25281-000000014042630D Assembly shows XOR instruction xor rax rsp in Stream UID: 16137-25320-0000000140428D02 Assembly shows XOR instruction xor eax esp in Stream UID: 16137-25320-0000000140428D02 Assembly shows XOR instruction xor rcx rsp in Stream UID: 16137-25320-0000000140428D02 Assembly shows XOR instruction xor ecx esp in Stream UID: 16137-25320-0000000140428D02 Assembly shows XOR instruction xor rax rsp in Stream UID: 16137-25329-000000014042922F Assembly shows XOR instruction xor eax esp in Stream UID: 16137-25329-000000014042922F Assembly shows XOR instruction xor rcx rsp in Stream UID: 16137-25329-000000014042922F Assembly shows XOR instruction xor ecx esp in Stream UID: 16137-25329-000000014042922F2b:T483,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm2c:T1108,Found XOR loop in file "sample.bin" at offset 1049348; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1859324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2850214; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3184886; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3538153; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3545556; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3846840; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3890070; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4149582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4937594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4956580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5095268; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5346337; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5777928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5790912; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5802444; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 294689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 599545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 679435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 978457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1495655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1501433; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1668681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2264129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2489745; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2669985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3449985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3450305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3612883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3665985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3763330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3989889; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4292367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4304696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4335482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4335546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4946550; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4969277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1206994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1230761; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1230982; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1331770; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1331792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4028229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4792488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4809099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4937560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4938990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4956700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5010923; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5066602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5194128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5485046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5566531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5626860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5764404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5799461; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5799469; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5819880; code bytes = 80302d:T424,Found system information discovery API: "GetEnvironmentStringsW" in file "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" Found system information discovery API: "GetSystemInfo" in file "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" Found system information discovery API: "GetNativeSystemInfo" in file "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" Found system information discovery API: "RtlNtStatusToDosError" in file "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp"2e:T55e,"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003860)2f:T727,"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")30:T9b0,"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00003860) "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00003860)31:T567,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp")32:Tc28d,Found reference to API (Indicator: "GetUserNameW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CreateThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CompareStringW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetLastError"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "ReadFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetFileType"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "LCMapStringW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "ReadFileEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "DeleteFileW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "TerminateProcess"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FindNextFileW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetCPInfo"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SleepEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SwitchToThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetACP"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "ExitProcess"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WriteFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WriteFileEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "lstrlenW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "UnregisterWaitEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CompareStringOrdinal"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CreateMutexA"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetOEMCP"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetTempPathW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CreateFileW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FindClose"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetStdHandle"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CreateProcessW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertOpenStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertCloseStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertDuplicateStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertDuplicateCertificateChain"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertGetCertificateChain"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "EncodePointer"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "HeapSize"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FormatMessageW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "ResumeThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "Thread32First"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "VirtualProtect"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CloseHandle"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RaiseException"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RtlUnwind"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "Thread32Next"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FlsSetValue"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetStdHandle"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "TlsGetValue"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetComputerNameExW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "TlsAlloc"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetLastError"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FreeLibrary"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "TlsFree"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FlsAlloc"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "HeapFree"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FlsGetValue"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetProcAddress"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "TlsSetValue"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "OpenThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SuspendThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "HeapAlloc"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "VirtualQuery"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "Sleep"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "VirtualFree"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FlsFree"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "NtReadFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "NtWriteFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "NtOpenFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "NtCreateFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "NtCreateNamedPipeFile"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CoInitialize"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CoUninitialize"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SysStringLen"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "SysFreeString"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FreeCredentialsHandle"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "FreeContextBuffer"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "AcquireCredentialsHandleA"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "InitializeSecurityContextW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "AcceptSecurityContext"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "EncryptMessage"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "QueryContextAttributesW"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "DecryptMessage"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "ApplyControlToken"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "DeleteSecurityContext"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "getpeername"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "ioctlsocket"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WSAIoctl"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WSACleanup"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "getsockname"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "getsockopt"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "closesocket"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WSASend"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "WSAStartup"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CompareStringEx"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003860.00000000.84916.20FC0000.00000004.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SysStringLen"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "ApplyControlToken"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "DecryptMessage"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "EncryptMessage"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "AcceptSecurityContext"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityContextW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FreeContextBuffer"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "DeleteSecurityContext"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "QueryContextAttributesW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "AcquireCredentialsHandleA"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FreeCredentialsHandle"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WriteFileEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "ReadFileEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "getsockopt"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WSAGetLastError"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "NtReadFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "NtWriteFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "NtOpenFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "NtCreateNamedPipeFile"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp")33:T456,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp")34:T156a,Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\io\impls.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "InvalidFileExtensionrequiresfound/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\option.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "a Display implementation returned an error unexpectedly/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\string.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\str\pattern.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\iter\traits\iterator.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\local.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\vec\spec_from_iter_nested.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") file/memory contains long string with (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\io\mod.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "DirectiveTemplateparamshashtemplate/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\clone\uninit.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "InvalidSystemTimeassertion failed: len > 0/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\node.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\sys\sync\once\futex.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "Errorattempt to join into collection with len > usize::MAX/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\str.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "internal error: entered unreachable codethreads should not terminate unexpectedly/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\mod.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "Crypto/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\borrow.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "0.0/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "Error/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\raw_vec\mod.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\navigate.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\borrow.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\time.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\slice\sort\stable\quicksort.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference string "called `Result::unwrap()` on an `Err` value/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\clone\uninit.rs" (Indicator: "/rustc/"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe")35:Ta7f,"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffebd5f0000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffecff60000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffecff60000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffecff60000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffecff60000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "KERNEL32" at base 7ffed3820000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "RPCRT4.DLL" at base 7ffed3680000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "SSPICLI.DLL" at base 7ffecfbf0000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffecf550000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffec8690000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffec8cc0000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffecf040000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffebf0e0000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffebf440000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffecfe80000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "KERNEL32.DLL" at base 7ffed3820000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffecf160000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ffebb420000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffed0920000 "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" loaded module "WS2_32.DLL" at base 7ffed38d000036:Td69,"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\0000000E"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\00000014"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\339FCF3A"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: ""; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: ""; Value: "")37:T9d8,"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: "SERIAL_ACCESS_NUM"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")38:T5e9,"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\SECUR32.DLL" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\secur32.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\Windows\System32\secur32.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\WINDOWS\SYSTEM32\secur32.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to touch file "C:\SSPICLI.DLL"39:T664,"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\SECUR32.DLL" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\secur32.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\SSPICLI.DLL" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\FLTLIB.DLL" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\MSVCP140.DLL" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\MSVCP140.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\BCRYPT.DLL" "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe" trying to access non-existent file "C:\CRYPTBASE.DLL"3a:T932,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "Network unreachabletcp connect error" (Indicator: " connect "; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "background connect error:" (Indicator: " connect "; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "HTTP/1.1 CONNECT request stripping path:" (Indicator: " connect "; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "tcp bind local error" (Indicator: " bind "; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "invalid socket address" (Indicator: " socket "; File: "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe") Found reference to API "Network unreachabletcp connect error" (Indicator: " connect "; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "background connect error:" (Indicator: " connect "; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "HTTP/1.1 CONNECT request stripping path:" (Indicator: " connect "; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "tcp bind local error" (Indicator: " bind "; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "invalid socket address" (Indicator: " socket "; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp")3b:T14daf,Heuristic match: "login.microsoftonline.com" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\api\register.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\eval\stmt.rs" Heuristic match: "cannot register indexer for arrays.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\module\mod.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "t_c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\task\core.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\de.rs" Heuristic match: "}command_typecommand_datarequest_idsuccessresulterrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\value\de.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\io\impls.rs" Heuristic match: "invalidfileextensionrequiresfound/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\option.rs" Heuristic match: "ient\src\signaller\mod.rs" Heuristic match: "client\src\artillery\mask.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-http-3.0.0\src\request_handler.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\ser.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.7\src\lib.rs" Heuristic match: "d:\a\antino\antino\shared\src\command_client.rs" Heuristic match: "a display implementation returned an error unexpectedly/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\string.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\str\pattern.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\iter\traits\iterator.rs" Heuristic match: "errorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\proxy.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\async_impl\response.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\local.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\context\current.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\multi_thread\mod.rs" Heuristic match: "core missingc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\current_thread\mod.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\vec\spec_from_iter_nested.rs" Pattern match: "https://graph.microsoft.com/.default00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899/rustc/1159e78c4747b" Heuristic match: "internal error: entered unreachable codec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\value\ser.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\template.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\span.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\io\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\position.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\iterators\flat_pairs.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\iterators\pair.rs" Heuristic match: "directivetemplateparamshashtemplate/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\parser.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\clone\uninit.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\combinators\collect.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\util.rs" Heuristic match: "url::form_urlencoded::serializer finishedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\form_urlencoded-1.2.2\src\lib.rs" Heuristic match: "invalidsystemtimeassertion failed: len > 0/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\node.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.10.1\src\bytes.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.10.1\src\bytes_mut.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\sys\sync\once\futex.rs" Heuristic match: "errorattempt to join into collection with len > usize::max/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\str.rs" Heuristic match: "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhjhljljljljljljljljljljljljljljljljljljljljljljljljljljljljljljpnpnpnpnpnpnpnp" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\multi_thread\queue.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\app_config.rs" Heuristic match: "zero capacity should never failc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Pattern match: "http://localhostredirect_uri" Heuristic match: "internal error: entered unreachable codethreads should not terminate unexpectedly/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\mod.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\iterators\pair.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\util\linked_list.rs" Heuristic match: "crypto/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\borrow.rs" Heuristic match: "0.0/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "rivate::rawvalue$serde_json::pric:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-http-3.0.0\src\request_handler.rs" Heuristic match: "d:\a\antino\antino\shared\src\command\registry.rs" Heuristic match: "error/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\raw_vec\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\util\sharded_list.rs" Heuristic match: "ioerrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\borrow.rs" Heuristic match: "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899errorc:\users\runneradmin\.cargo\registry\src\index.crat" Heuristic match: "fromutf8errorbyteserrorusize overflow when calculating b64 lengthc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\encode.rs" Heuristic match: "integer overflow when calculating buffer sizec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\mod.rs" Heuristic match: "internal error: entered unreachable codelibrary\panic_abort\src\lib.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\dynamic.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\time.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\module\resolvers\file.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\dynamic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\api\deprecated.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\array_basic.rs" Heuristic match: "called `result::unwrap()` on an `err` value/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\clone\uninit.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\thin-vec-0.2.14\src\lib.rs" Heuristic match: "rhai::types::immutable_string::immutablestringrhai::types::fn_ptr::fnptrfnptralloc::vec::vecarraybloballoc::collections::btree::map::btreemap, rhai::types::dynamic::d" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\ast\expr.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\ast\stmt.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\optimizer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\string_basic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\eval\data_check.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\func\builtin.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\error.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\blob_basic.rs" Heuristic match: "loopbreakreturnexitc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\parse_error.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\raw_vec\mod.rs" Heuristic match: "some/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\ast\namespace.rs" Heuristic match: "break statement should only be used inside a looplength of stringc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\scope.rs" Heuristic match: "get$is_anonymousc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\fn_basic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\string_more.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\smallvec-1.15.1\src\lib.rs" Heuristic match: "rhai::types::immutable_string::immutablestringfnptralloc::vec::vecarraybloballoc::collections::btree::map::btreemap, rhai::types::dynamic::dynamic>core::ops::range::r" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\api\files.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\eval\expr.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\scope.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\func\call.rs" Heuristic match: "`value` is shared (i.e. has outstanding references)c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\func\native.rs" Heuristic match: "{eof}c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\tokenizer.rs" Heuristic match: "commentreservedcustomunprocessedrawchareofc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\parse_error.rs" Heuristic match: "error/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: ")cannot register indexer for arrays.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\module\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\logic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\parse_error.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\func\register.rs" Heuristic match: "vcannot register indexer for arrays.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\module\mod.rs" Heuristic match: "string{eof}c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\dynamic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\math_basic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\time_basic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\smartstring-1.0.1\src\lib.rs" Heuristic match: "string{eof}>>=)const===continuecatch<<=forloop.<<<<=false**=letwhile++=throw}>>>>=;=>else//={****=||=:....=untilswitchprivatetrytruebreakreturnfnimport?.exportin(||^^=_::--=]()&&=%%=!!=!in[if,doas?[??&&#{?usecaseasyncpublicpackagesuper#varprotectedspawnsha" Heuristic match: "cannot advance position::nonec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\position.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\lang_core.rs" Heuristic match: "assertion failed: len > 0/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\node.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\vec\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\smartstring-1.0.1\src\ops.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\string.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\char\methods.rs" Heuristic match: "0x | rhai::types::immutable_string::immutablestringalloc::vec::vecalloc::collections::btree::map::btreemap, rhai::types::dynamic::dynamic>core::ops::range::rangeinclu" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\module\mod.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\ptr\mod.rs" Heuristic match: "error/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "fromutf8errorbyteserror/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\api\json.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\bit_field.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\arithmetic.rs" Heuristic match: "called `result::unwrap()` on an `err` value/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\iter_basic.rs" Heuristic match: "called `result::unwrap()` on an `err` valuelayouterror/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\smartstring-1.0.1\src\inline.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\smartstring-1.0.1\src\boxed.rs" Heuristic match: "t_c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\iterators\flat_pairs.rs" Heuristic match: "pathshared\src\command\list_files.rs" Heuristic match: "exit signal sent. client will shutdown.shared\src\command\exit.rs" Heuristic match: "()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\iterators\pair.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\future\try_join.rs" Heuristic match: "internal error: entered unreachable code/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\iter\traits\iterator.rs" Heuristic match: "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899c:\users\runneradmin\.cargo\registry\src\index.crates.io" Heuristic match: "l+c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\combinators\collect.rs" Heuristic match: "error/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "commandworking_dir.timeoutcmd/cshared\src\command\cmd.rs" Heuristic match: "systemtimeerror/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "falsetruefailed to spawn thread/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\mod.rs" Heuristic match: "shared\src\command\load_shellcode.rs" Heuristic match: "internal error: entered unreachable code/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\str\pattern.rs" Heuristic match: "called `result::unwrap()` on an `err` valueerrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\io\read_buf.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\io\util\read_to_end.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.11.4\src\map\core.rs" Heuristic match: "out of bounds accessc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\util.rs" Heuristic match: "nneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\template.rs" Heuristic match: "not valid unicodec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\whoami-1.6.1\src\os\windows.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hostname-0.3.1\src\windows.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\retour-0.3.1\src\alloc\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\retour-0.3.1\src\arch\x86\patcher.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\sync\poison\once.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\region-3.0.2\src\page.rs" Heuristic match: "sizec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\region-3.0.2\src\util.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\retour-0.3.1\src\arch\detour.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\retour-0.3.1\src\pic\emitter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\retour-0.3.1\src\arch\x86\trampoline\disasm.rs" Heuristic match: "poisonerror/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\retour-0.3.1\src\alloc\proximity.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\retour-0.3.1\src\arch\memory.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\once_cell-1.21.3\src\lib.rs" Heuristic match: "assertion failed: crate::arch::is_within_range(displacement)c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\retour-0.3.1\src\arch\x86\thunk\x86.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\retour-0.3.1\src\arch\x86\trampoline\mod.rs" Heuristic match: "poisoned chainc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\slice-pool2-0.4.3\src\sync\mod.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\slice\index.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\windows-core-0.52.0\src\imp\ref_count.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\clone.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\value\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\client_secret_credential.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\confidential_client_application.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.11.4\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\proxy.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\raw.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\allowed_host_validator.rs" Pattern match: "https://graph.microsoft.comhttps://graph.microsoft.ushttps://dod-graph.microsoft.ushttps://graph.microsoft.dehttps://microsoftgraph.chinacloudapi.cnhttps://canary.graph.microsoft.com" Heuristic match: "emptyhostidnaerrorinvalidportinvalidipv4addressinvalidipv6addressinvaliddomaincharacterrelativeurlwithoutbaserelativeurlwithcannotbeabasebasesethostoncannotbeabaseurloverflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5." Heuristic match: "base64 is always valid headervaluec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\util.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\authority.rs" Heuristic match: "graph_oauth::identity::credentials::client_secret_credentialc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\client_secret_credential.rs" Heuristic match: "serdejson/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\map.rs" Pattern match: "http://localhostc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\app_config.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\token.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\id_token.rs" Heuristic match: "fromutf8errorbyteserrorusize overflow when calculating b64 lengthc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\encode.rs" Heuristic match: "usize overflow when calculating buffer sizec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-core-3.0.0\src\http\response_converter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\value\de.rs" Heuristic match: "coderequest-iddatemessageinnererrorerror/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\iter\traits\iterator.rs" Heuristic match: "coderequest-iddatemessageinnererrorerror/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\local.rs" Heuristic match: "poll after poll::readyc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.4.13\src\util\ready.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\form_urlencoded-1.2.2\src\lib.rs" Heuristic match: "nonce/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde-1.0.228\src\private\de.rs" Heuristic match: "outputslicetoosmallwriter must be presentc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\blocking\wait.rs" Heuristic match: "systemtimeerrorsystem time before unix epochc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.42\src\offset\utc.rs" Heuristic match: "bdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.42\src\naive\internals.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.42\src\naive\date\mod.rs" Heuristic match: "retrying requires cloned requestc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.4.13\src\retry\future.rs" Heuristic match: "max requests in-flight; poll_ready must be called firstc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.4.13\src\limit\concurrency\service.rs" Heuristic match: "ready polled after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.31\src\future\ready.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-http-3.0.0\src\tower_services.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-http-3.0.0\src\client.rs" Heuristic match: "rust_min_stack/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\raw_vec\mod.rs" Heuristic match: "retry-afterfailed to spawn thread/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\dyn-clone-1.0.20\src\lib.rs" Heuristic match: "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-core-3.0.0\src\identity\client_application.rs" Heuristic match: "parseinterrorkindcannot parse integer from empty stringinvalid digit found in stringnumber too large to fit in target typenumber too small to fit in target typenumber would be zero for non-zero type/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\al" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\iterators\pairs.rs" Heuristic match: "utf8errorvalid_up_toerror_len/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\parser_state.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\ops\function.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\iter\adapters\cloned.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\iterators\line_index.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\str.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\general_purpose\decode_suffix.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\general_purpose\decode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\general_purpose\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\uuid-1.18.1\src\error.rs" Heuristic match: "assertion failed: (*tail).value.is_none()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.31\src\mpsc\queue.rs" Heuristic match: "assertion failed: buf.len() <= u32::max as usize/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\proto\h1\io.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\common\buf.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\rt\io.rs" Heuristic match: "parsed url is not a valid uric:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\error.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\async_impl\decoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\blocking\body.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\blocking\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\dns\gai.rs" Heuristic match: "httpc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "error/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\vec\mod.rs" Heuristic match: "emptyhostidnaerrorinvalidportinvalidipv4addressinvalidipv6addressinvaliddomaincharacterrelativeurlwithoutbaserelativeurlwithcannotbeabasebasesethostoncannotbeabaseurloverflow/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\async_impl\request.rs" Heuristic match: "zdinternal error: entered unreachable codec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.31\src\future\future\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-tls-0.6.0\src\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-native-tls-0.3.1\src\lib.rs" Heuristic match: "forcehttpsbuturinothttps/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "timedoutc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\connect.rs" Heuristic match: "not droppedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\pool.rs" Heuristic match: "assertion failed: slot.is_none()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.31\src\oneshot.rs" Heuristic match: "someusize overflow when calculating b64 lengthc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\rt\io.rs" Heuristic match: "size overflows max_sizec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "proxy-authorization: c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\connect\proxy\tunnel.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\proto\h1\conn.rs" Heuristic match: "000current header namec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\proto\h1\encode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.2\src\timeout\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.31\src\mpsc\mod.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\sync\atomic.rs" Heuristic match: "assertion failed: self.inner.semaphore.is_idle()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\sync\mpsc\chan.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\sync\oneshot.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\async_impl\body.rs" Heuristic match: "threadidc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\sync\mpsc\unbounded.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\async_impl\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\redirect.rs" Heuristic match: "overflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\rt\io.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\io\read_buf.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\rt\tokio.rs" Heuristic match: "bytes remaining on streamc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-util-0.7.16\src\io\stream_reader.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\extensions.rs" Heuristic match: "polled feed after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.31\src\sink\feed.rs" Heuristic match: "unable to find any user-specified roots in the final cert chainc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.28\src\tls_stream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\connect.rs" Heuristic match: "future polled after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-native-tls-0.3.1\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-util-0.7.16\src\util\poll_buf.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\async-compression-0.4.32\src\tokio\bufread\generic\decoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\compression-codecs-0.4.31\src\gzip\header.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\compression-codecs-0.4.31\src\gzip\decoder.rs" Heuristic match: "filled overflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\net\tcp\socket.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\net\tcp\stream.rs" Heuristic match: "errc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "poisonerrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.10.1\src\buf\take.rs" Heuristic match: "senderror/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\pool.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\connect\http.rs" Heuristic match: "tryflatten polled after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.31\src\future\try_future\try_flatten.rs" Heuristic match: "a,%/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\local.rs" Heuristic match: "unexpected eof during chunk size linec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\proto\h1\decode.rs" Heuristic match: "errorassertion failed: self.is_char_boundary(new_len)/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\value\ser.rs" Heuristic match: "internal error: entered unreachable codec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\ser.rs" Heuristic match: "any valid json valuea string keyraw valueinf-infnanc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.11.4\src\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.11.4\src\map\core\entry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hashbrown-0.16.0\src\raw\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\inflate\stream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\inflate\core.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\inflate\output_buffer.rs" Heuristic match: "error:///rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\raw_vec\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.8\src\parser\char.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.8\src\normalize\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.8\src\normalize\pct_case.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.8\src\parser\validate\path.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\str\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.8\src\parser\str.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.8\src\parser\trusted.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.8\src\components.rs" Heuristic match: "/[validity] non-relative iri must have a schemec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.8\src\normalize.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.8\src\parser\validate.rs" Heuristic match: "rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\time.rs" Heuristic match: "called `result::unwrap()` on an `err` valuelayouterrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.28\src\alpn_list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\uri\scheme.rs" Heuristic match: "base64 is always valid headervaluec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\proxy\matcher.rs" Heuristic match: "|usize overflow when calculating b64 lengthc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" Heuristic match: "invaliduripartsfieldset corrupted (this is a bug)c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\client.rs" Heuristic match: "invalidurioutputslicetoosmallwriter must be presentc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" Heuristic match: "[internal exception] blocking task ran twice.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\blocking\task.rs" Heuristic match: "invalid url, scheme is not httpinvalid url, scheme is missinginvalid url, host is missingfieldset corrupted (this is a bug)c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\connect\http.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\mod.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ipnet-2.11.0\src\parser.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tracing-core-0.1.34\src\dispatcher.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tracing-core-0.1.34\src\field.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tracing-core-0.1.34\src\callsite.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\sync.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tracing-core-0.1.34\src\callsite.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\once_cell-1.21.3\src\imp_std.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\proto\h1\role.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\value.rs" Heuristic match: "chunk_size_max_bytes should fit any usizec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\proto\h1\encode.rs" Heuristic match: "original header value plus ascii is validc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\headers.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\body\incoming.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\proto\h1\decode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\httparse-1.10.1\src\lib.rs" Heuristic match: "send failed because channel is fullsend failed because receiver is goneinternal error: entered unreachable codec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\method.rs" Heuristic match: "invalidstatuscodeinvalid status codeinternal error: entered unreachable codec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\uri\scheme.rs" Heuristic match: "sensitiveinvalidheadervaluefailed to parse header valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.10.1\src\bytes_mut.rs" Heuristic match: "invalidmethodinvalid http method/zero capacity should never failc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\uri\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\uri\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\uri\authority.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-core-0.3.31\src\task\__internal\atomic_waker.rs" Heuristic match: "httphttpswswssftpfilec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.7\src\parser.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.7\src\path_segments.rs" Heuristic match: "assertion failed: code_point < self.header.high_start && self.header.high_start > small_limitc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\icu_collections-2.0.0\src\codepointtrie\cptrie.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\uts46.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\punycode.rs" Heuristic match: "allocerrlayoutc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\smallvec-1.15.1\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\icu_normalizer-2.0.0\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\multi_thread\idle.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\multi_thread\worker.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\util\wake_list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\context.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\current_thread\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\defer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\park.rs" Heuristic match: "a tokio 1.x context was found, but io is disabled. call `enable_io` on the runtime builder to enable io.a tokio 1.x context was found, but timers are disabled. call `enable_time` on the runtime builder to enable timers.c:\users\runneradmin\.cargo\registry\" Heuristic match: "assertion failed: self.tail.is_none()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\util\linked_list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\time\wheel\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\time\mod.rs" Heuristic match: "not ready yetc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\process\windows.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\io\poll_evented.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\io\registration.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\sync\batch_semaphore.rs" Heuristic match: "internal error: entered unreachable code/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\sys\thread_local\native\lazy.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\io\blocking.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\socket2-0.6.0\src\sys\windows.rs" Heuristic match: "<= c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.10.1\src\bytes_mut.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.10.1\src\lib.rs" Heuristic match: "called `result::unwrap()` on an `err` valueout of bounds access/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.0.4\src\sys\windows\selector.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.0.4\src\sys\windows\mod.rs" Heuristic match: "poisonedpoisonerrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.0.4\src\sys\windows\iocp.rs" Heuristic match: "handlec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.0.4\src\sys\windows\event.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parking_lot_core-0.9.11\src\parking_lot.rs" Heuristic match: "rwlock reader count overflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parking_lot-0.12.4\src\raw_rwlock.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parking_lot-0.12.4\src\condvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parking_lot_core-0.9.11\src\thread_parker\windows\mod.rs" Heuristic match: "backtrace capture failedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.100\src\error.rs" Heuristic match: "sc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.100\src\fmt.rs" Heuristic match: "library\std\src\panicking.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\node.rs" Heuristic match: "assertion failed: self.is_char_boundary(new_len)/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\raw_vec\mod.rs" Heuristic match: "library\std\src\rt.rs" Heuristic match: "library\std\src\thread\scoped.rs" Heuristic match: "library\std\src\thread\current.rs" Heuristic match: "library\std\src\thread\local.rs" Heuristic match: "library\std\src\thread\mod.rs" Heuristic match: "library\std\src\sync\lazy_lock.rs" Heuristic match: "library\std\src\backtrace.rs" Heuristic match: "library\std\src\env.rs" Heuristic match: "library\std\src\sys_common\wtf8.rs" Heuristic match: "library\std\src\ffi\os_str.rs" Heuristic match: "library\std\src\io\buffered\bufwriter.rs" Heuristic match: "library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "library\std\src\io\buffered\linewritershim.rs" Heuristic match: "library\std\src\io\stdio.rs" Heuristic match: "stdoutlibrary\std\src\io\mod.rs" Heuristic match: "handlepanicked at :library\std\src\path.rs" Heuristic match: "library\std\src\sync\poison\once.rs" Heuristic match: "lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs" Heuristic match: "overflow when adding duration to instantlibrary\std\src\time.rs" Heuristic match: "library\std\src\sys_common\mod.rs" Heuristic match: "library\std\src\alloc.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "library\std\src\sys\pal\windows\os.rs" Heuristic match: "library\std\src\sys\pal\windows\pipe.rs" Heuristic match: "library\std\src\sys\pal\windows\thread.rs" Heuristic match: "library\std\src\sys\pal\windows\time.rs" Heuristic match: "y\std\src\sys\pal\windows\mod.rs" Heuristic match: "library\std\src\sys\args\windows.rs" Heuristic match: "library\std\src\sys\env\windows.rs" Heuristic match: "filepath*assertion failed: len >= size_of::()library\std\src\sys\net\connection\socket.rs" Heuristic match: "library\std\src\sys\net\connection\socket\windows.rs" Heuristic match: "std\src\sys\path\windows.rs" Heuristic match: "library\std\src\sys\path\windows_prefix.rs" Heuristic match: "library\std\src\sys\process\windows.rs" Heuristic match: "library\std\src\sys\stdio\windows.rs" Heuristic match: "library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "library\std\src\sys\thread_local\destructors\list.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.25\src\legacy.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.25\src\v0.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.25\src\lib.rs" Heuristic match: "/rust/deps\hashbrown-0.15.4\src\raw\mod.rs" Heuristic match: "library\alloc\src\raw_vec\mod.rs" Heuristic match: "library\alloc\src\string.rs" Heuristic match: "library\alloc\src\ffi\c_str.rs" Heuristic match: "a formatting trait implementation returned an error when the underlying stream did notlibrary\alloc\src\fmt.rs" Heuristic match: "library\alloc\src\rc.rs" Heuristic match: "library\alloc\src\slice.rs" Heuristic match: "library\alloc\src\str.rs" Heuristic match: "library\alloc\src\sync.rs" Heuristic match: "library\core\src\num\dec2flt\decimal_seq.rs" Heuristic match: "library\core\src\num\dec2flt\parse.rs" Heuristic match: "cannot parse float from empty stringinvalid float literallibrary\core\src\num\diy_float.rs" Heuristic match: "library\core\src\num\flt2dec\strategy\dragon.rs" Heuristic match: "library\core\src\num\flt2dec\strategy\grisu.rs" Heuristic match: "library\core\src\num\flt2dec\mod.rs" Heuristic match: "library\core\src\char\methods.rs" Heuristic match: "library\core\src\net\ip_addr.rs" Heuristic match: "library\core\src\net\display_buffer.rs" Heuristic match: "library\core\src\net\parser.rs" Heuristic match: "library\core\src\net\socket_addr.rs" Heuristic match: "called `option::unwrap()` on a `none` valuelibrary\core\src\panicking.rs" Heuristic match: "library\core\src\fmt\builders.rs" Heuristic match: "library\core\src\fmt\num.rs" Heuristic match: "library\core\src\fmt\mod.rs" Heuristic match: "library\core\src\slice\memchr.rs" Heuristic match: "library\core\src\slice\sort\shared\smallsort.rs" Heuristic match: "library\core\src\str\pattern.rs" Heuristic match: "smsslibrary\core\src\time.rs" Heuristic match: "library\core\src\unicode\printable.rs" Heuristic match: "library\core\src\unicode\unicode_data.rs" Heuristic match: "library\core\src\num\bignum.rs" Heuristic match: "adg.akadns.net" Heuristic match: "ogin.microsoftonline.com" Heuristic match: ".microsoftonline.com" Heuristic match: "ntrust.net" Pattern match: "http://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" Pattern match: "https://graph.microsoft.com/.defaultnaksi" Pattern match: "https://graph.microsoft.com/.default\" Pattern match: "https://graph.microsoft.com/.defaultn" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "https://graph.microsoft.com/f" Pattern match: "https://graph.microsoft.us/" Pattern match: "https://canary.graph.microsoft.com/" Pattern match: "https://dod-graph.microsoft.us/" Pattern match: "https://login.microsoftonline.com/df622d8d-49d3-4dea-9222-a3475dd63ead/oauth2/v2.0/token" Pattern match: "https://microsoftgraph.chinacloudapi.cn/" Pattern match: "http://localhost/" Pattern match: "https://graph.microsoft.de/" Pattern match: "https://graph.microsoft.com/v1.0" Pattern match: "https://graph.microsoft.com/.default" Pattern match: "https://graph.microsoft.com/" Pattern match: "crosoft.com/v1.0/users/6a9a3baa-7873-43f7-b9b8-a63cf1588302" Heuristic match: "stamp2.login.microsoftonline.com" Heuristic match: "login.microsoftonline-int.com" Heuristic match: "login.microsoftonline-p.com" Heuristic match: "login2.microsoftonline-int.com" Heuristic match: "login2.microsoftonline.com" Heuristic match: "loginex.microsoftonline-int.com" Heuristic match: "loginex.microsoftonline.com" Heuristic match: "$stamp2.login.microsoftonline-int.com" Pattern match: "crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "crosoft.com/v1.0/users/6a9a3baa-7873-43f7-b9b8-a63cf1588302/messages" Pattern match: "https://login.microsoftonline.com/df622d8d-49d3-4dea-9222-a3475dd63ead/oauth2/v2.0/tokenj" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "https://login.microsoftonline.com" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Heuristic match: "ft.cc" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2f" Pattern match: "www.microsoft.com/pki/certs/miccertrl" Pattern match: "http://crl.microsoft" Heuristic match: "host: login.microsoftonline.com" Pattern match: "https://*.msauth.net" Heuristic match: "failed to spawn thread/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\mod.rs" Heuristic match: "client\src\signaller\mod.rs" Heuristic match: "client\src\core.rs" Heuristic match: "client\src\main.rs" Heuristic match: "capacity overflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\thin-vec-0.2.14\src\lib.rs" Heuristic match: "responsestreamc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\parse_error.rs" Heuristic match: "writing rfc3339 datetime to string should never failc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.42\src\datetime\mod.rs" Heuristic match: "client\src\config\mod.rs" Heuristic match: "failed to park threadc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\multi_thread\mod.rs" Pattern match: "https://github.com/sreeise/graph-rs-sdk/issues/root{{rid}}/content" Heuristic match: "interpolated stringc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\api\register.rs" Heuristic match: "anon$cannot register indexer for arrays.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\module\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\map_basic.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\rc.rs" Heuristic match: "optionsindexandorcoalescec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\ast\expr.rs" Heuristic match: "a numbera floating-point numbera charactera stringan arrayan object mapa boolean expressiona booleanan iterable valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\dynamic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\defer.rs" Heuristic match: "get$set$c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\eval\cache.rs" Heuristic match: "index$get$index$set$c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\eval\chaining.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\eval\target.rs" Heuristic match: "attempt to join into collection with len > usize::max/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\str.rs" Heuristic match: "to_stringc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\packages\string_more.rs" Heuristic match: "length of stringc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\parse_error.rs" Heuristic match: "core::ops::range::rangecore::ops::range::rangeinclusiveu16u128u64i32i128i16u8u32i8zipnamespacenameaccessprivatepublicis_anonymousthis_typeparamsc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rhai-1.23.4\src\types\parse_" Heuristic match: "f/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "list_filesload_shellcodeadd_to_runshared\src\com_executor.rs" Heuristic match: "shared\src\command\system_info.rs" Heuristic match: "program_pathshared\src\command\execute_program.rs" Heuristic match: "errorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\header\map.rs" Heuristic match: "shared\src\command\upload_file.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\process\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\future\maybe_done.rs" Heuristic match: "commandworking_dir.timeoutpowershell-commandshared\src\command\powershell.rs" Heuristic match: "shared\src\command\download_file.rs" Heuristic match: "tryfrominterrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\windows-0.52.0\src\windows\win32\system\registry\mod.rs" Heuristic match: "shared\src\command\add_to_run.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\io\util\vec_with_initialized.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.10.1\src\buf\take.rs" Heuristic match: "is_directorynamec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\template.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\region-3.0.2\src\os\windows.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mmap-fixed-fixed-0.1.3\src\lib.rs" Heuristic match: "assertion failed: idx < capacity/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\btree\node.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-rs-sdk-3.0.1\src\client\graph.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lazy_static-1.5.0\src\inline_lazy.rs" Pattern match: "https://graph.microsoft.com/v1.0p" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\token_credential_executor.rs" Pattern match: "https://github.com/sreeise/graph-rs-sdk/issues/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\borrow.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\time-0.3.44\src\interop\offsetdatetime_systemtime.rs" Heuristic match: "event c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\token_credential_executor.rs:56graph_oauth::identity::credentials::token_credential_executorc:\users\runneradmin\.cargo\registry\src\" Heuristic match: "$serde_json::private::rawvaluevalue is missing/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "access_tokentoken_typeexpires_inext_expires_inscoperefresh_tokenuser_idid_tokenstatesession_statecorrelation_idclient_infoc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\token.rs" Heuristic match: "silent token auth failed/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\raw_vec\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\output.rs" Heuristic match: "./rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\borrow.rs" Heuristic match: "hash table capacity overflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hashbrown-0.5.0\src\raw\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\render.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\context.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\helpers\helper_log.rs" Heuristic match: "param not found for helper lookupinsufficient params for helper lookupc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\support.rs" Heuristic match: "falsetrue/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\borrow.rs" Heuristic match: "somec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.11.4\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\helpers\helper_with.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.11.4\src\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\partial.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\stack.rs" Heuristic match: "call limit reachedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\position.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\handlebars-2.0.4\src\helpers\helper_each.rs" Heuristic match: "lg.hk" Heuristic match: "threadidout of bounds access/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "cannot poll select twicec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.31\src\future\select.rs" Heuristic match: "abort request bodyc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\blocking\client.rs" Heuristic match: "reqwest-internal-sync-runtimec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.7\src\lib.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\pool.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.23\src\retry.rs" Heuristic match: "current header namec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\proto\h1\encode.rs" Heuristic match: "/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\boxed\convert.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\connect\dns.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\client\conn\http1.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\compression-core-0.4.29\src\util.rs" Heuristic match: "8c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\net\tcp\socket.rs" Heuristic match: "elapsedoutputslicetoosmallwriter must be presentc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\proto\h1\encode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.10.1\src\buf\chain.rs" Heuristic match: "`ready` polled after completion/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\future\ready.rs" Heuristic match: "authority implies hostc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\client.rs" Heuristic match: "threadidc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\client\conn\http1.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\net\tcp\socket.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\sync\mpsc\unbounded.rs" Heuristic match: "already calledc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\service\oneshot.rs" Heuristic match: "retrying requires cloned requestc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.2\src\retry\future.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\client\dispatch.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\sync\mpsc\list.rs" Heuristic match: "connection closedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\common\lazy.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.2\src\util\oneshot.rs" Heuristic match: "fieldset corrupted (this is a bug)c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.17\src\client\legacy\client.rs" Heuristic match: "invalid chunk size line: missing size digitinvalid chunk size: overflowchunk trailers bytes over limitc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.10.1\src\bytes_mut.rs" Heuristic match: "chunk trailers count overflowinvalid trailer end lfinvalid chunk size line: invalid sizeconnection errorconnection was not readyc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.7.0\src\client\conn\http1.rs" Heuristic match: "pooldisabledcheckoutnolongerwantedcheckedoutclosedvalue/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "nullc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\error.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.145\src\read.rs" Heuristic match: "poisonerrorassertion failed: ttl >= duration::from_secs(1)c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.2\src\retry\budget\tps_budget.rs" Heuristic match: "request timed outc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\native-tls-0.2.14\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.28\src\security_context.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.28\src\schannel_cred.rs" Heuristic match: "httphttps/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\str\pattern.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\want-0.3.1\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\atomic-waker-1.1.2\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\sync\semaphore.rs" Heuristic match: "http/0.9http/1.0http/1.1http/2.0http/3.0c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.3.1\src\version.rs" Heuristic match: "called `result::unwrap()` on an `err` valueassertion failed: self.is_char_boundary(new_len)/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.7\src\host.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\percent-encoding-2.3.2\src\lib.rs" Heuristic match: "threads should not terminate unexpectedly/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\thread\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\loom\std\mod.rs" Heuristic match: "assertion failed: next.is_notified()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\task\state.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\blocking\shutdown.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\task\coop\mod.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\time\sleep.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\task\harness.rs" Heuristic match: "task was cancelledtask panicked/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\raw_vec\mod.rs" Heuristic match: "filled overflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\io\poll_evented.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\time\entry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\scheduler\multi_thread\park.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\task\list.rs" Heuristic match: "internal error: entered unreachable codec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\sync\notify.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\blocking\pool.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\handle.rs" Heuristic match: "called `result::unwrap()` on an `err` valuepoisonerrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\util\linked_list.rs" Heuristic match: "assertion failed: c.runtime.get().is_entered()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\context\runtime.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\metrics\worker.rs" Heuristic match: "rng seed generator is internally corruptc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\util\rand\rt.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\io\driver.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\io\registration_set.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.47.1\src\runtime\blocking\schedule.rs" Heuristic match: "socket != -1/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\std\src\os\windows\io\raw.rs" Heuristic match: "overflow in duration::new/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\time.rs" Heuristic match: "library\std\src\path.rs" Heuristic match: "library\std\src\sys\pal\windows\mod.rs" Heuristic match: "library\std\src\sys\path\windows.rs" Heuristic match: "ww.tm.a.prd.aadg.akadns.net" Heuristic match: "k.privatelink.msidentity.com" Pattern match: "http://lpj" Pattern match: "https://*.msftauth.net" Pattern match: "https://login.microsoftonline.com/df622d8d-49d3-4dea-9222-a3475dd63ead/oauth2/v2.0/token^" Pattern match: "https://graph.microsoft.com/v1.0/users/6a9a3baa-7873-43f7-b9b8-a63cf1588302conte" Pattern match: "http://localhost/02z" Pattern match: "http://localhost/yby" Pattern match: "https://graph.microsoft.com/.defaultnaks" Pattern match: "https://graph.microsoft.com/v1.05ltonaksc" Pattern match: "https://graph.microsoft.com/v1.0/users/" Pattern match: "https://graph.microsoft.com/v1.0/users/6a9a3baa-7873-43f7-b9b8-a63cf1588302/messages" Pattern match: "www.microsoft.com/pki/crl/pr" Pattern match: "www.microsoft.co" Pattern match: "https://login.microsoftonline.com/df622d8d-49d3-4dea-9222-a3475dd63ead/oauth2/v2.0/tokenf" Pattern match: "crl.microsoft.com/pki/crl" Heuristic match: "ogin.microsoftonline-int.com" Heuristic match: "ogin.microsoftonline-p.com" Heuristic match: "ogin2.microsoftonline-int.com" Heuristic match: "ogin2.microsoftonline.com" Heuristic match: "oginex.microsoftonline-int.com" Heuristic match: "stamp2.login.microsoftonline-int.com" Heuristic match: "ogin.mso.msidentity.com" Heuristic match: ".prd.aadg.akadns.net" Pattern match: "https://login.microsoftonline.com/df622d8d-49d3-4dea-9222-a3475dd63ead/oauth2/v2.0/tokenl" Heuristic match: "rl3.digicert.com" Pattern match: "https://graph.microsoft.com/v1.0ope=naks" Pattern match: "https://graph.microsoft.com/.defaultnaks0bx" Pattern match: "http://localhost/#" Pattern match: "https://login.microsoftonline.comc23naks" Pattern match: "https://graph.microsoft.com/v1.0/users/6a9a3baa-7873-43f7-b9b8-a63cf1588302/messagesoken" Pattern match: "digicert.com/mitmproxy-236356893075616227624" Pattern match: "crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" Heuristic match: "ity.com" Heuristic match: "e.com" Heuristic match: "login.mso.msidentity.com" Pattern match: "https://graph.microsoft.com/v1.0/users/6a9a3baa-7873-43f7-b9b8-a63cf1588302"3c:T229e,Found URL "http://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crloftware\microsoft\cryptography\oid\encodingtype" - Source: "00000000-00003860.00000000.84916.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultnaksiovx8q" - Source: "00000000-00003860.00000000.84916.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default\ovx8q" - Source: "00000000-00003860.00000000.84916.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultndf622d8d-49d3-4dea-9222-a3475dd63eadologonserver=\\desktop-fvvf82aprogramfiles=c:\program" - Source: "00000000-00003860.00000000.84916.20FC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003860.00000000.84916.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\str\pattern.rsinternal" - Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found URL "http://localhostredirect_uriinternal" - Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found URL "https://github.com/sreeise/graph-rs-sdk/issues/root" - Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found URL "https://graph.microsoft.com/v1.0pc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pest-2.8.2\src\iterators\pair.rsinternal" - Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found URL "https://graph.microsoft.comhttps://graph.microsoft.ushttps://dod-graph.microsoft.ushttps://graph.microsoft.dehttps://microsoftgraph.chinacloudapi.cnhttps://canary.graph.microsoft.coma" - Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found URL "https://login.microsoftonline.comhttps://login.chinacloudapi.cnhttps://login.microsoftonline.dehttps://login.microsoftonline.usadfscommonorganizationsconsumers//oauth2/v2.0/tokenc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\authority.rsc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\client_secret_credential.rs/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\core\src\option.rsc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\app_config.rsfieldset" - Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found URL "https://github.com/sreeise/graph-rs-sdk/issues/rustc/1159e78c4747b02ef996e55082b704c09b970588\library\alloc\src\borrow.rsusernamepasswordpa" - Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found URL "http://localhostc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\graph-oauth-3.0.0\src\identity\credentials\app_config.rsabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789-_456789:;<=" - Source: "00000000-00003860.00000000.84916.BED4F000.00000002.mdmp") Found URL "http://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crllogin.microsoftonline.comlogin.microsoftonline.comlogin.microsoftonline.comhttp07561622762411051962http://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crlpinrules_autoupdate_1http://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crlhttp07561622762411051962login.microsoftonline.comhttp://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crlisallowedcert_autoupdate_1subcamicrosoftigicertectigoeotrusterisignsa/sha256etwork" - Source: "00000000-00003860.00000001.86837.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultnaksiovx8q" - Source: "00000000-00003860.00000001.86837.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default\ovx8q" - Source: "00000000-00003860.00000001.86837.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultndf622d8d-49d3-4dea-9222-a3475dd63eadologonserver=\\desktop-fvvf82aprogramfiles=c:\program" - Source: "00000000-00003860.00000001.86837.20FC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003860.00000001.86837.20FC0000.00000004.mdmp") Found URL "http://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crlhttp://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crlhttp://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crlpinrules_autoupdate_1login.microsoftonline.comhttp://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crllogin.microsoftonline.comlogin.microsoftonline.comhttp07561622762411051962http://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crlhttp://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crlisallowedcert_autoupdate_1subcamicrosoftigicertectigoeotrusterisignsa/sha256msiscanbuffererial_access_numtlgetversionerial_access_numetwork" - Source: "00000000-00003860.00000002.88758.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultnaksiovx8q" - Source: "00000000-00003860.00000002.88758.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.default\ovx8q" - Source: "00000000-00003860.00000002.88758.20FC0000.00000004.mdmp") Found URL "https://graph.microsoft.com/.defaultndf622d8d-49d3-4dea-9222-a3475dd63eadologonserver=\\desktop-fvvf82aprogramfiles=c:\program" - Source: "00000000-00003860.00000002.88758.20FC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003860.00000002.88758.20FC0000.00000004.mdmp") Found URL "http://crl3.digicert.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0^\" (Indicator: \"SHA512\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp, 00000000-00003860.00000001.86837.20FC0000.00000004.mdmp, 00000000-00003860.00000002.88758.20FC0000.00000004.mdmp\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - exe\\\\.\\NUL; Source: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found string - exe\\\\.\\NUL; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Uses Rust based deflate/zlib compression/decompression library","description":"Found string \"C:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-1949cf8c6b5b557f\\miniz_oxide-0.8.9\\src\\inflate\\core.rs\" (Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-636","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Uses Rust compression library for archiving","description":"Found string \"C:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-1949cf8c6b5b557f\\miniz_oxide-0.8.9\\src\\inflate\\core.rs\" (Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":3,"id":"string-637","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp, 00000000-00003860.00000001.86837.20FC0000.00000004.mdmp, 00000000-00003860.00000002.88758.20FC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp, 00000000-00003860.00000001.86837.20FC0000.00000004.mdmp, 00000000-00003860.00000002.88758.20FC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"Internal error please file an issue on GitHub https://github.com/sreeise/graph-rs-sdk/issues/root{{RID}}/content\" (Indicator: \"github.com\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found string \"Internal error please file an issue on GitHub https://github.com/sreeise/graph-rs-sdk/issues/rustc/1159e78c4747b02ef996e55082b704c09b970588\\library\\alloc\\src\\borrow.rs\" (Indicator: \"github.com\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExW\" (Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00003860)\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"GetUserNameExW\" with parameters (UID: 00000000-00003860)\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003860)\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003860)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003860)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003860)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 16137-6354-00000001403EC1E0\n FindFirstFileExW@KERNEL32.dll at 16137-25320-0000000140428D02","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@kernel32.dll at 16137-29369-0000000140418ABD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimePreciseAsFileTime@KERNEL32.dll at 16137-6361-00000001403EAF40\n GetSystemTimeAsFileTime@kernel32.dll at 16137-29369-0000000140418ABD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@kernel32.dll at 16137-6402-00000001403E08B0\n GetNativeSystemInfo@kernel32.dll at 16137-8289-00000001402497D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003860.00000002.88758.20FC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@kernel32.dll at 16137-8275-000000014024B0E0\n GetProcessHeap@kernel32.dll at 16137-8276-000000014024AD00\n GetProcessHeap@kernel32.dll at 16137-8278-000000014024B4E0\n GetProcessHeap@kernel32.dll at 16137-8279-000000014024AEC0\n GetProcessHeap@kernel32.dll at 16137-8280-000000014024B9C0\n GetProcessHeap@kernel32.dll at 16137-8281-000000014024B3B0\n OpenProcessToken@advapi32.dll at 16137-19004-000000014023035A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003860)\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003860)\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003860)\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003860)\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003860)\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"LoadLibrary\" with a parameter WS2_32.dll (UID: 00000000-00003860)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"antino_client_template.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"NtCreateNamedPipeFile@ntdll.dll at 16137-24741-00000001403F145A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@kernel32.dll at 16137-6027-0000000140449250\n WaitForSingleObject@kernel32.dll at 16137-6330-00000001403F08B0\n WaitForSingleObject@kernel32.dll at 16137-6385-00000001403E57B0\n Sleep@kernel32.dll at 16137-6477-00000001403D4E40\n RegisterWaitForSingleObject@KERNEL32.dll at 16137-6560-00000001403CB630\n WaitForSingleObject@kernel32.dll at 16137-6563-00000001403EA580\n WaitForSingleObject@kernel32.dll at 16137-6565-00000001403CB620\n WaitForSingleObject@kernel32.dll at 16137-7620-00000001403F1C00\n WaitForSingleObject@kernel32.dll at 16137-8057-00000001403E0370","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@kernel32.dll at 16137-8276-000000014024AD00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"$34","origin":"File/Memory","relevance":1,"id":"string-943","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Internal error please file an issue on GitHub https://github.com/sreeise/graph-rs-sdk/issues/root{{RID}}/content\" (Indicator: \"github.com\")\n \"Internal error please file an issue on GitHub https://github.com/sreeise/graph-rs-sdk/issues/rustc/1159e78c4747b02ef996e55082b704c09b970588\\library\\alloc\\src\\borrow.rs\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at CFE80000\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at CF820000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D3680000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" was detected as \"Rust\" and name: \"Compiler\"\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Matched Rust compiler","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" was detected as \"Rust\" compiled binary\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-182","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" has an writable section named \".data\"\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" has an writable section named \".fptable\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140418a9c,add\trsp, 0x28,jmp\t0x140418590,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,nop\tword ptr [rax + rax],sub\trsp, 0x10,mov\tqword ptr [rsp], r10,mov\tqword ptr [rsp + 8], r11,xor\tr11, r11,lea\tr10, [rsp + 0x18],sub\tr10, rax,cmovb\tr10, r11,mov\tr11, qword ptr gs:[0x10],cmp\tr10, r11,jae\t0x140418770,and\tr10w, 0xf000,lea\tr11, [r11 - 0x1000],mov\tbyte ptr [r11], 0,cmp\tr10, r11,jne\t0x140418760,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x44dc00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x117200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x44dba0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1170fc\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"login.microsoftonline.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.dll at 16137-8329-00000001402454A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" queries basic process information of the \"C:\\40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" (UID: 3860)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5411BEA2C2D6D798726E302B0BBEF11B\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: 40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n \"2.5.29.31\"\n \"127.0.0.1:34254socket != -1\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3c","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://graph.microsoft.com\"\n Found HTTPS url \"https://graph.microsoft.comhttps\"\n Found HTTPS url \"https://dod\"\n Found HTTPS url \"https://graph.microsoft.dehttps\"\n Found HTTPS url \"https://canary.graph.microsoft.com\"\n Found HTTPS url \"https://login.microsoftonline.comhttps\"\n Found HTTPS url \"https://login.microsoftonline.dehttps\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Rust-compiled binary","description":"YARA signature for Rust-compiled binary file \"sample.bin\"","origin":"YARA Signature","relevance":1,"id":"yara-185","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp, 00000000-00003860.00000001.86837.20FC0000.00000004.mdmp, 00000000-00003860.00000002.88758.20FC0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp, 00000000-00003860.00000001.86837.20FC0000.00000004.mdmp, 00000000-00003860.00000002.88758.20FC0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp, 00000000-00003860.00000001.86837.20FC0000.00000004.mdmp, 00000000-00003860.00000002.88758.20FC0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp, 00000000-00003860.00000001.86837.20FC0000.00000004.mdmp, 00000000-00003860.00000002.88758.20FC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"GetUserNameW\" (UID: 00000000-00003860)\n \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$41","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\Afd\\Mio\" (Indicator: \"\\Device\\\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found string \"\\Device\\HarddiskVolume2\\40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003860.00000000.84916.20FC0000.00000004.mdmp, 00000000-00003860.00000001.86837.20FC0000.00000004.mdmp, 00000000-00003860.00000002.88758.20FC0000.00000004.mdmp\")\n Found string \"\\Device\\Afd\\Mio\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found string \"Failed to open \\Device\\Afd\\Mio: 0\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003860.00000000.84916.BED4F000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: 40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"Found reference to API \"shared\\src\\command\\load_shellcode.rs\" (Indicator: \"shellcode\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found reference to API \"error: no shellcode dataerror: no configerror:\" (Indicator: \"shellcode\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"list_filesload_shellcodeadd_to_runshared\\src\\com_executor.rs\" (Indicator: \"shellcode\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")\n Found reference to API \"shared\\src\\command\\load_shellcode.rs\" (Indicator: \"shellcode\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00003860.00000000.84916.20FC0000.00000004.mdmp, 00000000-00003860.00000001.86837.20FC0000.00000004.mdmp, 00000000-00003860.00000002.88758.20FC0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".cfg\" has very low entropy (0.05)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3860)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003860.00000000.84916.BED4F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/24 Antivirus vendors marked sample as malicious (37% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"General","name":"Able to start/interact with device drivers","description":"NtDeviceIoControlFile@ntdll.dll at 16137-6487-00000001403D3B60","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":5,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@KERNEL32.dll at 16137-8467-00000001403E38E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"OpenThread@kernel32.dll at 16137-9859-0000000140017390\n OpenThread@kernel32.dll at 16137-18707-000000014021EBBB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in process \"00000000-00003860\"\n YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@kernel32.dll at 16137-9859-0000000140017390\n CreateToolhelp32Snapshot@kernel32.dll at 16137-18707-000000014021EBBB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 16137-6341-00000001403F11A0\n GetModuleFileNameA@kernel32.dll at 16137-19004-000000014023035A\n GetModuleFileNameW@KERNEL32.dll at 16137-25329-000000014042922F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtReadFile@ntdll.dll at 16137-6330-00000001403F08B0\n NtReadFile@ntdll.dll at 16137-6385-00000001403E57B0\n NtCreateFile@ntdll.dll at 16137-6482-00000001403D26D0\n NtDeviceIoControlFile@ntdll.dll at 16137-6487-00000001403D3B60\n NtOpenFile@ntdll.dll at 16137-24741-00000001403F145A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameW\n RegOpenKeyExW\n CreateThread\n GetSystemDirectoryW\n GetModuleFileNameW\n LoadLibraryA\n DeleteFileW\n TerminateProcess\n FindNextFileW\n SleepEx\n WriteFile\n WriteFileEx\n GetCommandLineW\n GetTempPathW\n FindFirstFileExW\n CreateFileW\n CreateDirectoryW\n GetFileAttributesW\n CreateProcessW\n GetCommandLineA\n OpenProcessToken\n MapViewOfFile\n VirtualProtect\n GetModuleHandleW\n GetSystemInfo\n VirtualAlloc\n GetComputerNameExW\n LoadLibraryExA\n CreateToolhelp32Snapshot\n UnhandledExceptionFilter\n GetStartupInfoW\n GetProcAddress\n IsDebuggerPresent\n Sleep\n GetNativeSystemInfo\n GetModuleFileNameA\n CreateFileMappingW\n GetModuleHandleA\n GetModuleHandleExW\n LoadLibraryExW\n bind\n WSASocketW\n connect\n recv\n closesocket\n WSASend\n WSAStartup\n send","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]}],"intel_graph":{"map":{"Domain:login.microsoftonline.com":{"type":"Domain","value":"login.microsoftonline.com"},"File:40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d":{"type":"File","value":"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as trojan by ClamAV antivirus"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"Ip:40.126.62.131":{"type":"Ip","value":"40.126.62.131"}},"chains":[{"id":"1556954750796075161","root":"File:40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as trojan by ClamAV antivirus"]}},{"id":"sandbox_network","root":"File:40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d","edges":[{"edge_kind":"contacted_domain","from_key":"File:40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d","to_key":"Domain:login.microsoftonline.com"},{"edge_kind":"resolves_to","from_key":"Domain:login.microsoftonline.com","to_key":"Ip:40.126.62.131"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ac4b916201239b59405148e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":83,"malware_family":"Trojan.RustyEtiquette","contacted_countries":["USA"],"submit_name":"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe","analysis_start_time":"2026-10-06T09:02:17+00:00","indicators_count":{"informative":142,"suspicious":40,"malicious":1},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"login.microsoftonline.com","address":"40.126.62.131","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}],"processes":[{"pid":3860,"ppid":0,"name":"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe","command_line":"","sha256":"40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d","normalized_path":"C:\\40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d.exe","uid":"00000000-00003860","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["bcrypt.dll","bcryptprimitives.dll","secur32.dll","sspicli.dll","imm32.dll","gpapi.dll","advapi32.dll","msvcrt.dll","ole32.dll","user32.dll","mswsock.dll","ntasn1.dll","cryptnet.dll","kernel32.dll","KernelBase.dll","gdi32full.dll","schannel.dll","msvcp_win.dll","msasn1.dll","cryptsp.dll","ncrypt.dll","ncryptsslp.dll","profapi.dll","ntdll.dll","rpcrt4.dll","combase.dll","VxSSL64.dll","fltLib.dll","vcruntime140.dll","vcruntime140_1.dll","FWPUCLNT.DLL","ws2_32.dll","shlwapi.dll","IPHLPAPI.DLL","mskeyprotect.dll","cryptbase.dll","ucrtbase.dll","crypt32.dll","gdi32.dll","nsi.dll","rasadhlp.dll","rsaenh.dll","apphelp.dll","sechost.dll","oleaut32.dll","win32u.dll","msvcp140.dll","dnsapi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ac4b916201239b59405148e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ac4b916201239b59405148e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win64/HackTool.RustRegion Sample 40e7e77aff60… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 40e7e77aff60…. Malware family: Win64/HackTool.RustRegion. Threat score 100/100. 10/28 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/HackTool.RustRegion Sample 40e7e77aff60… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 40e7e77aff60…. Malware family: Win64/HackTool.RustRegion. Threat score 100/100. 10/28 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/HackTool.RustRegion Sample 40e7e77aff60… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 40e7e77aff60…. Malware family: Win64/HackTool.RustRegion. Threat score 100/100. 10/28 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L43","11",{}]]