24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/Generic Sample 5327308fee51… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5327308fee51…. Malware family: Trojan/Generic. Threat score 100/100. 16/26 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db","keywords":["Malicious","Trojan/Generic","malware analysis","sandbox report","threat intelligence","5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db"],"about":{"@type":"SoftwareApplication","name":"bounty-19849700513833551","applicationCategory":["peexe","64bits","executable"],"identifier":"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/Generic","antivirusDetections":{"malicious":16,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T61c,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db")26:T75b,Assembly shows XOR instruction xor al 01h in Stream UID: 46482-2422-000000014000517C Assembly shows XOR instruction xor byte ptr [rax] bl in Stream UID: 46482-2781-000000014000ADCF Assembly shows XOR instruction xor byte ptr [rax] r15L in Stream UID: 46482-2781-000000014000ADCF Assembly shows XOR instruction xor byte ptr [rax] bh in Stream UID: 46482-2781-000000014000ADCF Assembly shows XOR instruction xor rdx rax in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor edx eax in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor rdi rdx in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor edi edx in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor rax rdi in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor eax edi in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor rbx rax in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor ebx eax in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor rax rcx in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor eax ecx in Stream UID: 46482-2868-00000001400C6A6B Assembly shows XOR instruction xor byte ptr [rax] bl in Stream UID: 46482-2890-000000014000B11A Assembly shows XOR instruction xor dl sil in Stream UID: 46482-2932-000000014000CD77 Assembly shows XOR instruction xor dl dh in Stream UID: 46482-2932-000000014000CD77 Assembly shows XOR instruction xor ecx r8d in Stream UID: 46482-3981-000000014004FFBB Assembly shows XOR instruction xor ecx eax in Stream UID: 46482-3981-000000014004FFBB Assembly shows XOR instruction xor al 01h in Stream UID: 46482-5996-00000001400BE42A Assembly shows XOR instruction xor edi 0Fh in Stream UID: 46482-6212-00000001400CEECB27:T16a8,Found string "alserueullC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\serde_json-1.0.82\src\de.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\serde_json-1.0.82\src\ser.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "attempt to calculate the remainder with a divisor of zeroC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\block-buffer-0.10.2\src\lib.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\body\to_bytes.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\thread_pool\mod.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\mod.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rand_core-0.6.3\src\block.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\reqwest-0.11.11\src\async_impl\response.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\adler-1.0.2\src\algo.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "Overflow when calculating number of chunks in inputC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\base64-0.13.0\src\decode.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\bit_reader\mod.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\huffman\mod.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\transform.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\decode.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "LayoutErrorC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crc32fast-1.3.2\src\baseline.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crossbeam-epoch-0.9.10\src\sync\list.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\flate2-1.0.24\src\ffi\rust.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\flate2-1.0.24\src\zio.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "CompressErrorC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-core-0.3.21\src\task\__internal\atomic_waker.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\indexmap-1.9.1\src\map.rs(z" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\indexmap-1.9.1\src\map\core.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\indexmap-1.9.1\src\map\core\raw.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\decoder.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "encoding header without name, but no previous index to use for nameC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\encoder.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string ":status:protocol:path:scheme:method:authorityC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\huffman\mod.rs" (Indicator: "github.com"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db")28:T2287,"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter NtReadFile (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter NtWriteFile (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter NtCreateKeyedEvent (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter NtReleaseKeyedEvent (UID: 00000000-00006328) "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" called "GetProcAddress" with a parameter NtWaitForKeyedEvent (UID: 00000000-00006328)29:T4b79,Found reference to API (Indicator: "EnumProcessModulesEx"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "RegCloseKey"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "RegQueryValueExW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "OpenProcessToken"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "RegOpenKeyExW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "LookupAccountSidW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetTokenInformation"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "BCryptGenRandom"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertCloseStore"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertDuplicateCertificateChain"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertGetCertificateChain"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertOpenStore"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertDuplicateStore"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetTcpTable"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetAdaptersAddresses"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "ReleaseMutex"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CreateEventW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SetHandleInformation"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WriteConsoleW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "HeapFree"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetProcessTimes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetModuleFileNameW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "VirtualQueryEx"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "DuplicateHandle"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "FormatMessageW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetExitCodeProcess"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "HeapReAlloc"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetCurrentThreadId"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CreateThread"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CreateFileW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetProcessHeap"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetConsoleMode"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CopyFileExW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetLastError"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "HeapAlloc"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CancelIo"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CloseHandle"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "ReadProcessMemory"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "DeleteFileW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "LocalFree"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CreateMutexA"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetOverlappedResult"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "ReadFileEx"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SwitchToThread"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetModuleHandleA"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SetLastError"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetFileAttributesW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetCurrentThread"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "InitializeSListHead"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetModuleHandleW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "OpenProcess"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetProcessId"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "DeviceIoControl"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetSystemTimes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SleepEx"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "lstrlenW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetSystemInfo"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "Sleep"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetProcAddress"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WaitForSingleObject"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WriteFileEx"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CreateProcessW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "IsDebuggerPresent"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WakeConditionVariable"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetStdHandle"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CreateNamedPipeW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetCurrentProcess"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CompareStringOrdinal"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetProcessIoCounters"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetFullPathNameW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "ReadFile"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "LoadLibraryA"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetTickCount64"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetCurrentProcessId"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CreateDirectoryW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "NtCreateFile"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "RtlGetVersion"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "RtlCaptureContext"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CoUninitialize"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CoTaskMemFree"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "DeleteSecurityContext"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "DecryptMessage"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "ApplyControlToken"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "AcceptSecurityContext"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "FreeContextBuffer"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "QueryContextAttributesW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "FreeCredentialsHandle"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "InitializeSecurityContextW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "EncryptMessage"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "AcquireCredentialsHandleA"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "CommandLineToArgvW"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "ioctlsocket"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "getsockname"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WSASend"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "getsockopt"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "getpeername"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WSAIoctl"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WSACleanup"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WSAStartup"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "WSAGetLastError"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "closesocket"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "SetThreadDescription"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API (Indicator: "NtWriteFile"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db")2a:Te29,"alserueullC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\serde_json-1.0.82\src\de.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\serde_json-1.0.82\src\ser.rs" (Indicator: "github.com") "attempt to calculate the remainder with a divisor of zeroC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\block-buffer-0.10.2\src\lib.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\body\to_bytes.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\thread_pool\mod.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\mod.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rand_core-0.6.3\src\block.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\reqwest-0.11.11\src\async_impl\response.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\adler-1.0.2\src\algo.rs" (Indicator: "github.com") "Overflow when calculating number of chunks in inputC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\base64-0.13.0\src\decode.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\bit_reader\mod.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\huffman\mod.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\transform.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\decode.rs" (Indicator: "github.com") "LayoutErrorC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crc32fast-1.3.2\src\baseline.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crossbeam-epoch-0.9.10\src\sync\list.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\flate2-1.0.24\src\ffi\rust.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\flate2-1.0.24\src\zio.rs" (Indicator: "github.com") "CompressErrorC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-core-0.3.21\src\task\__internal\atomic_waker.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\indexmap-1.9.1\src\map.rs(z" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\indexmap-1.9.1\src\map\core.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\indexmap-1.9.1\src\map\core\raw.rs" (Indicator: "github.com") "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\decoder.rs" (Indicator: "github.com") "encoding header without name, but no previous index to use for nameC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\encoder.rs" (Indicator: "github.com") ":status:protocol:path:scheme:method:authorityC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\huffman\mod.rs" (Indicator: "github.com")2b:T85b,"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")2c:T1003,"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "5327308FEE51FC6BB95996C4185C4CFCBAC580B747D79363C7CF66505F3FF6DB"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "")2d:T6ce,"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\IPHLPAPI.DLL" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\Windows\System32\IPHLPAPI.DLL" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\PDH.DLL" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\Windows\System32\pdh.dll" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\BCRYPT.DLL" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\SECUR32.DLL" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\Windows\System32\secur32.dll" "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe" trying to touch file "C:\Windows\System32\bcrypt.dll"2e:T6fa4,Heuristic match: "alserueullc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\serde_json-1.0.82\src\de.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\serde_json-1.0.82\src\ser.rs" Heuristic match: "attempt to calculate the remainder with a divisor of zeroc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\block-buffer-0.10.2\src\lib.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\std\src\io\readbuf.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\core\src\fmt\mod.rs" Heuristic match: "attempt to join into collection with len > usize::max/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\alloc\src\str.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\body\to_bytes.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\thread_pool\mod.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\mod.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rand_core-0.6.3\src\block.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\reqwest-0.11.11\src\async_impl\response.rs" Heuristic match: "src\.\tcp_conn\windows.rs" Heuristic match: "src\systeminfo\info.rs" Heuristic match: "key is nilsrc\transport\mod.rs" Heuristic match: "statuscode != 200src\kernel\scheduler.rs" Heuristic match: "/xml/tn/createsrc\kernel\mod.rs" Heuristic match: "src\doh\mod.rs" Heuristic match: "failed building the runtimesrc\main.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\adler-1.0.2\src\algo.rs" Heuristic match: "library\alloc\src\raw_vec.rs" Heuristic match: "library\alloc\src\ffi\c_str.rs" Heuristic match: "a formatting trait implementation returned an errorlibrary\alloc\src\fmt.rs" Heuristic match: "library\alloc\src\vec\mod.rs" Heuristic match: "overflow when calculating number of chunks in inputc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\base64-0.13.0\src\decode.rs" Pattern match: "birthpopuptypesapplyimagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedtermspartsgroupbrandusingwomanfalsereadyaudiotakeswhile.com/livedcasesdailychildgreatjudgethoseunitsneverbroadcoastcoverapplefilescycles" Pattern match: "thing.org/multiheardpowerstandtokensolid" Pattern match: "genretrucklooksvalueframe.net/--" Pattern match: "tos.org/ladvisedpenaltysimple:if" Pattern match: "http://mathematicsmargin-top:eventually" Pattern match: "http://descriptionrelatively" Pattern match: "http://applicationslink" Pattern match: "http://navigation" Pattern match: "http://px" Pattern match: "www.world" Pattern match: "http://www.years" Pattern match: "http://interested" Pattern match: "http://familiar" Pattern match: "https://was" Pattern match: "https://ain" Pattern match: "http://whether" Pattern match: "http://interpreted" Pattern match: "http://addeventlistenerresponsible" Pattern match: "http://.jpg|right|thumb|.js" Pattern match: "http://html4/loose.dtd" Pattern match: "http://an" Pattern match: "w3.org/1999/xhtml" Pattern match: "http://imenglish" Pattern match: "http://www" Pattern match: "http://iparticipation" Pattern match: "http://.css" Pattern match: "http://ator" Pattern match: "http://www-//w3c//dtd" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\bit_reader\mod.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\huffman\mod.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\transform.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\brotli-decompressor-2.3.2\src\decode.rs" Heuristic match: "assertion failed: edelta >= 0library\core\src\num\diy_float.rs" Heuristic match: "library\core\src\num\flt2dec\strategy\grisu.rs" Heuristic match: "library\core\src\num\flt2dec\mod.rs" Heuristic match: "library\core\src\panicking.rs" Heuristic match: "library\core\src\slice\index.rs" Heuristic match: "library\core\src\str\pattern.rs" Heuristic match: "library\core\src\unicode\printable.rs" Heuristic match: "library\core\src\unicode\unicode_data.rs" Heuristic match: "library\core\src\num\bignum.rs" Heuristic match: "layouterrorc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crc32fast-1.3.2\src\baseline.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crossbeam-epoch-0.9.10\src\sync\list.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\flate2-1.0.24\src\ffi\rust.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\flate2-1.0.24\src\zio.rs" Heuristic match: "compresserrorc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-core-0.3.21\src\task\__internal\atomic_waker.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\indexmap-1.9.1\src\map\core.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\indexmap-1.9.1\src\map\core\raw.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\decoder.rs" Heuristic match: "encoding header without name, but no previous index to use for namec:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\encoder.rs" Heuristic match: ":status:protocol:path:scheme:method:authorityc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\huffman\mod.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\hpack\table.rs" Heuristic match: "assertion failed: !id.is_zero()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\proto\peer.rs" Heuristic match: "assertion failed: self.can_inc_num_recv_streams()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\proto\streams\counts.rs" Heuristic match: "invalid initial receive windowc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\proto\streams\stream.rs" Heuristic match: "http_1_1_requiredinadequate_securityenhance_your_calmconnect_errorcompression_errorcancelrefused_streamframe_size_errorstream_closedsettings_timeoutflow_control_errorinternal_errorprotocol_errorno_errorassertion failed: default_max_frame_size <= val && val" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\frame\stream_id.rs" Heuristic match: "halfclosedlocalreservedremotereservedlocalscheduledlibraryresetendstreamstreamidc:\users\runneradmin\.cargo\registry\src\github.com-1ecc6299db9ec823\hashbrown-0.12.0\src\raw\mod.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hashbrown-0.12.3\src\raw\mod.rs" Heuristic match: "invalidstatuscodeinvalid status codec:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\http-0.2.8\src\uri\authority.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\std\src\io\impls.rs" Heuristic match: "patchconnecttraceheaddeleteputpostgetoptions/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\alloc\src\sync.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\body\body.rs" Heuristic match: "h2::error::is_ioc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\error.rs" Heuristic match: "uritoolonguriversionh2methodtransferencodingunexpectedcontentlengthinvalidmanualupgradenoupgradeabsoluteurirequiredunsupportedrequestmethodunsupportedversionservicebodywriteabortedclosechunkedoriginal header value plus ascii is validc:\users\administrator\" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\proto\h2\ping.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\proto\h1\role.rs" Heuristic match: "checked out connection was closedcheckoutisclosederrorhttps required but uri was not httpsforcehttpsbuturinothttpsc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\unicode-normalization-0.1.21\src\decompose.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\idna-0.2.3\src\punycode.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\idna-0.2.3\src\uts46.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\ipnet-2.5.0\src\parser.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\miniz_oxide-0.5.3\src\deflate\core.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\miniz_oxide-0.5.3\src\inflate\core.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\miniz_oxide-0.5.3\src\inflate\output_buffer.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\miniz_oxide-0.5.3\src\inflate\stream.rs" Heuristic match: "afdpollinfoiostatusblockc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\mio-0.8.4\src\sys\windows\selector.rs" Heuristic match: "hc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\mio-0.8.4\src\sys\windows\mod.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\once_cell-1.13.0\src\imp_std.rs" Heuristic match: "library\panic_abort\src\lib.rs" Heuristic match: "attempted to use a condition variable with more than one mutexc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\parking_lot-0.12.1\src\condvar.rs" Heuristic match: "rwlock reader count overflowc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\parking_lot-0.12.1\src\raw_rwlock.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\parking_lot_core-0.9.3\src\parking_lot.rs" Heuristic match: "parking_lot requires either nt keyed events (winxp+) or waitonaddress/wakebyaddress (win8+)c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\parking_lot_core-0.9.3\src\thread_parker\windows\mod.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rand-0.8.5\src\rngs\thread.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rand_chacha-0.3.1\src\guts.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crossbeam-deque-0.8.2\src\deque.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crossbeam-epoch-0.9.10\src\internal.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crossbeam-channel-0.5.6\src\waker.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\crossbeam-channel-0.5.6\src\flavors\zero.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rayon-core-1.9.3\src\sleep\mod.rs" Heuristic match: "globalpoolalreadyinitializedmap must not be polled after it returned `poll::ready`c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-util-0.3.21\src\future\future\map.rs" Heuristic match: "future polled after completionc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-native-tls-0.3.0\src\lib.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-tls-0.5.0\src\client.rs" Heuristic match: "`async fn` resumed after completionc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\async-compression-0.3.14\src\codec\brotli\decoder.rs" Heuristic match: "reached unexpected eofunable to find any user-specified roots in the final cert chainc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-util-0.7.3\src\lib.rs" Heuristic match: "bytes remaining on streamout of bounds accesspolling streamfuture twicec:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-util-0.3.21\src\stream\stream\into_future.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\client\connect\http.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\async-compression-0.3.14\src\tokio\bufread\generic\decoder.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-channel-0.3.21\src\mpsc\mod.rs" Heuristic match: "assertion failed: slot.is_none()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-channel-0.3.21\src\oneshot.rs" Heuristic match: "flatten polled after completionc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-util-0.3.21\src\future\future\flatten.rs" Heuristic match: "tryflatten polled after completionc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-util-0.3.21\src\future\try_future\try_flatten.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\async-compression-0.3.14\src\util.rs" Heuristic match: "parser used after donec:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\async-compression-0.3.14\src\codec\gzip\header.rs" Heuristic match: "brotli errorassertion failed: default_max_frame_size as usize <= val && val <= max_max_frame_size as usizec:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\codec\framed_read.rs" Heuristic match: "assertion failed: self.has_capacity()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\codec\framed_write.rs" Heuristic match: "assertion failed: dst.remaining_mut() >= lenc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\frame\data.rs" Heuristic match: "invalid goaway framec:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\proto\go_away.rs" Heuristic match: "invalid rst_stream framec:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\proto\streams\recv.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\proto\streams\store.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\proto\streams\buffer.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\proto\streams\streams.rs" Heuristic match: "invalid ping framec:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\proto\ping_pong.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\h2-0.3.13\src\client.rs" Heuristic match: "assertion failed: buf.len() <= c::ulong::max as usize/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\std\src\sys\windows\io.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\http-0.2.8\src\uri\path.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\http-0.2.8\src\uri\scheme.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\http-0.2.8\src\header\value.rs" Heuristic match: "invalid keyc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\slab-0.4.7\src\lib.rs" Heuristic match: "unexpected eof during chunk size lineinvalid chunk end lfinvalid chunk body crinvalid chunk body lfinvalid chunk size lf (invalid chunk size linear white spaceinvalid chunk extension contains newlineinvalid trailer end lfinvalid chunk size: overflowinvalid" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\client\conn.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\client\pool.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\client\connect\dns.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\common\exec.rs" Heuristic match: "buf.len() must fit in remaining()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\net\tcp\socket.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\net\tcp\stream.rs" Heuristic match: "assertion failed: self.inner.semaphore.is_idle()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\sync\mpsc\chan.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\sync\mpsc\list.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\bytes-1.2.1\src\bytes.rs" Heuristic match: "datawriter must be presentc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\base64-0.13.0\src\write\encoder.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\common\buf.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\bytes-1.2.1\src\buf\chain.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\common\lazy.rs" Heuristic match: "ready polled after completionc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-util-0.3.21\src\future\ready.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\io\util\write_all.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\hyper-0.14.20\src\service\oneshot.rs" Heuristic match: "cannot poll select twicec:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\futures-util-0.3.21\src\future\select.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\reqwest-0.11.11\src\async_impl\client.rs" Heuristic match: "gzip, brbasic c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\reqwest-0.11.11\src\async_impl\request.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\reqwest-0.11.11\src\connect.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\alloc\src\vec\spec_from_iter_nested.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\lazy_static-1.4.0\src\inline_lazy.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\schannel-0.1.20\src\alpn_list.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\serde_json-1.0.82\src\read.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\std\src\sync\once.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\socket2-0.4.4\src\sys\windows.rs" Heuristic match: "127.0.0.1:34254/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\core\src\slice\iter.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\alloc\src\vec\spec_extend.rs" Heuristic match: "library\std\src\rt.rs" Heuristic match: "accesserrorlibrary\std\src\thread\local.rs" Heuristic match: "library\std\src\thread\mod.rs" Heuristic match: "rust_backtracelibrary\std\src\env.rs" Heuristic match: "library\std\src\io\stdio.rs" Heuristic match: "library\std\src\net\ip.rs" Heuristic match: "library\std\src\net\parser.rs" Heuristic match: "library\std\src\panic.rs" Heuristic match: "\library\std\src\process.rs" Heuristic match: "library\std\src\sync\once.rs" Heuristic match: "overflow when adding duration to instantlibrary\std\src\time.rs" Heuristic match: "pathlock count overflow in reentrant mutexlibrary\std\src\sys_common\remutex.rs" Heuristic match: "rust_min_stacklibrary\std\src\sys_common\thread_info.rs" Heuristic match: "library\std\src\sys_common\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "library\std\src\sys\windows\io.rs" Heuristic match: "library\std\src\sys\windows\net.rs" Heuristic match: "library\std\src\sys\windows\pipe.rs" Heuristic match: "library\std\src\sys\windows\process.rs" Heuristic match: "library\std\src\sys\windows\rand.rs" Heuristic match: "library\std\src\sys\windows\thread.rs" Heuristic match: "library\std\src\sys\windows\thread_parker.rs" Heuristic match: "library\std\src\sys\windows\time.rs" Heuristic match: "library\std\src\sys\windows\mod.rs" Heuristic match: "library\std\src\sys\windows\stack_overflow.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rayon-core-1.9.3\src\job.rs" Heuristic match: "assertion failed: injected && !worker_thread.is_null()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rayon-core-1.9.3\src\registry.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "assertion failed: vec.capacity() - start >= lenc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rayon-1.5.3\src\vec.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rayon-core-1.9.3\src\latch.rs" Heuristic match: "internal error: entered unreachable code/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\std\src\thread\mod.rs" Heuristic match: "cannot access a thread local storage value during or after destruction/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\std\src\thread\local.rs" Heuristic match: "attempt to calculate the remainder with a divisor of zeroalready mutably borrowedassertion failed: mid <= self.len()/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\core\src\slice\mod.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\alloc\src\slice.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\alloc\src\collections\vec_deque\ring_slices.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\park\thread.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\util\wake_list.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\util\linked_list.rs" Heuristic match: "failed to find event loopreactor at max registered i/o resourcesc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\io\poll_evented.rs" Heuristic match: "assertion failed: c.get().is_entered()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\enter.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\task\core.rs" Heuristic match: "assertion failed: snapshot.is_complete()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\task\harness.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\task\list.rs" Heuristic match: "assertion failed: next.is_notified()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\task\state.rs" Heuristic match: "cannot start a runtime from within a runtime. this happens because a function (like `block_on`) attempted to block the current thread while the thread is being used to drive asynchronous tasks.queue not emptyc:\users\administrator\.cargo\registry\src\githu" Heuristic match: "idoh no! we never placed the core back, this is a bug!c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\basic_scheduler.rs" Heuristic match: "assertion failed: shared.shutdown_tx.is_some()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\blocking\pool.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\blocking\schedule.rs" Heuristic match: "[internal exception] blocking task ran twice.c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\blocking\task.rs" Heuristic match: "tokio-runtime-workerc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\context.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\thread_pool\park.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\thread_pool\queue.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\runtime\thread_pool\worker.rs" Heuristic match: "assertion failed: waiter.notified.is_none()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\sync\notify.rs" Heuristic match: "timer already firedc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\entry.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\wheel\level.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\wheel\mod.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\sleep.rs" Heuristic match: "assertion failed: !self.handle.is_shutdown()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\mod.rs" Heuristic match: "timer duration exceeds maximum durationtimer is at capacity and cannot create a new entrythe timer is shutdown, must be called from the context of tokio runtimedeadline has elapsed`period` must be non-zero.c:\users\administrator\.cargo\registry\src\github." Heuristic match: "a tokio 1.x context was found, but timers are disabled. call `enable_time` on the runtime builder to enable timers.elapsedassertion failed: value <= self.max_value()c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\uti" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\util\slab.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\bytes-1.2.1\src\bytes_mut.rs" Heuristic match: "provided length would overflow after adjustmentlengthdelimitedcodecerrorframe size too bigmessagealready borrowedpoisonerrorlazy instance has previously been poisonedc:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\once_cell-1.13.0\sr" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\unicode-normalization-0.1.21\src\perfect_hash.rs" Heuristic match: "a display implementation returned an error unexpectedly/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\alloc\src\string.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\url-2.2.2\src\host.rs" Pattern match: "parser.rs//file://" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\url-2.2.2\src\lib.rs" Heuristic match: "c:\users\administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\want-0.3.0\src\lib.rs" Heuristic match: "/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\library\core\src\str\pattern.rs"2f:T536,file/memory contains long string with (Indicator: "HTTP/1.1"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "HTTP/1.1HTTP/1.0BodyLength::Unknown would set chunked" (Indicator: "HTTP/1.1"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "HTTP/1.1HTTP/1.0BodyLength::Unknown would set chunked" (Indicator: "HTTP/1.0"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "HTTP/1.1 100 Continue" (Indicator: "HTTP/1.1"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "CONNECT HTTP/1.1Host:" (Indicator: "HTTP/1.1"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "User-Agent: Proxy-Authorization: HTTP/1.1 200HTTP/1.0 200proxy headers too long for tunnelHTTP/1.1 407proxy authentication requiredunsuccessful tunnelunexpected eof while tunneling" (Indicator: "HTTP/1.1"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "User-Agent: Proxy-Authorization: HTTP/1.1 200HTTP/1.0 200proxy headers too long for tunnelHTTP/1.1 407proxy authentication requiredunsuccessful tunnelunexpected eof while tunneling" (Indicator: "HTTP/1.0"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db")30:T9e1,Found string "Overflow when calculating number of chunks in inputC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\base64-0.13.0\src\decode.rs" (Indicator: "base64"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "jovendichaestantalessalirsuelopesosfinesllamabusco" (Indicator: "aes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "cuandoenviarmadridbuscariniciotiempoporquecuentaestadopuedenjuegoscontraest" (Indicator: "aes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "alatinafuerzaestiloguerraentrar" (Indicator: "aes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "deutscheuropeueuskaragaeilgesvenskaespa" (Indicator: "aes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "digoportadaespaciofamiliaantoniopermiteguardaralgunaspreciosalguiensentidovisitast" (Indicator: "aes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "ltimaestamosoficialtambienning" (Indicator: "aes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "ncompletaestudiosp" (Indicator: "aes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "aescribirmedicinalicenciaconsultaaspectoscr" (Indicator: "aes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "aespecialesdisponibleactualidadreferenciavalladolidbibliotecarelacionescalendariopol" (Indicator: "aes"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rand_chacha-0.3.1\src\guts.rs" (Indicator: "chacha"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "DataWriter must be presentC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\base64-0.13.0\src\write\encoder.rs" (Indicator: "base64"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\base64-0.13.0\src\encode.rsInvalid UTF8" (Indicator: "base64"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "base64 is always valid HeaderValue" (Indicator: "base64"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db")31:T436,Found reference to API "EnumProcessModulesEx" (Indicator: "EnumProcessModules"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db")32:T6c5,Found string "Failed to open \Device\Afd\Mio:" (Indicator: "\Device\"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "IO driver has terminatedC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\io\driver\mod.rsi/o driver event store missing" (Indicator: "\driver\"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "Timer already firedC:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\entry.rs" (Indicator: "\driver\"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\wheel\level.rs" (Indicator: "\driver\"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\wheel\mod.rs" (Indicator: "\driver\"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\sleep.rs" (Indicator: "\driver\"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "assertion failed: !self.handle.is_shutdown()C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.20.1\src\time\driver\mod.rs" (Indicator: "\driver\"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db") Found string "\Device\Afd\Mio" (Indicator: "\Device\"; File: "5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791218310633,"unified_at":"2026-10-05T16:38:30.633Z","metadata":{"hashes":{"sha256":"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db","sha1":"d27daaaad5351efc32617c5d0bfc151c4eaab528","md5":"fd58bfb0ee6a4e076af317346a7d8584","sha512":"fe22d29d9b146f131541ee188cfa34cd505ac4fb85180c47e2cbfe16af32b3c211f76e3def79437b36bb2cac3d938e9ac87e100b67717ae1c9ce2f92218154b9","ssdeep":"24576:8XBDYSkSOQzTiwLAEZ6R7OkSAdJQml8C7n3yKpbbeAApi4Qn652m:yR8QHdkEZ6kkSAdnCKdbe3iv","ssdeep_chunks":["24576:8XBDYSk","24576:XBDYSkS","24576:BDYSkSO","24576:DYSkSOQ","24576:YSkSOQz","24576:SkSOQzT","24576:kSOQzTi","24576:SOQzTiw","24576:OQzTiwL","24576:QzTiwLA","24576:zTiwLAE","24576:TiwLAEZ","24576:iwLAEZ6","24576:wLAEZ6R","24576:LAEZ6R7","24576:AEZ6R7O","24576:EZ6R7Ok","24576:Z6R7OkS","24576:6R7OkSA","24576:R7OkSAd","24576:7OkSAdJ","24576:OkSAdJQ","24576:kSAdJQm","24576:SAdJQml","24576:AdJQml8","24576:dJQml8C","24576:JQml8C7","24576:Qml8C7n","24576:ml8C7n3","24576:l8C7n3y","24576:8C7n3yK","24576:C7n3yKp","24576:7n3yKpb","24576:n3yKpbb","24576:3yKpbbe","24576:yKpbbeA","24576:KpbbeAA","24576:pbbeAAp","24576:bbeAApi","24576:beAApi4","24576:eAApi4Q","24576:AApi4Qn","24576:Api4Qn6","24576:pi4Qn65","24576:i4Qn652","24576:4Qn652m","49152:8XBDYSk","49152:XBDYSkS","49152:BDYSkSO","49152:DYSkSOQ","49152:YSkSOQz","49152:SkSOQzT","49152:kSOQzTi","49152:SOQzTiw","49152:OQzTiwL","49152:QzTiwLA","49152:zTiwLAE","49152:TiwLAEZ","49152:iwLAEZ6","49152:wLAEZ6R","49152:LAEZ6R7","49152:AEZ6R7O","49152:EZ6R7Ok","49152:Z6R7OkS","49152:6R7OkSA","49152:R7OkSAd","49152:7OkSAdJ","49152:OkSAdJQ","49152:kSAdJQm","49152:SAdJQml","49152:AdJQml8","49152:dJQml8C","49152:JQml8C7","49152:Qml8C7n","49152:ml8C7n3","49152:l8C7n3y","49152:8C7n3yK","49152:C7n3yKp","49152:7n3yKpb","49152:n3yKpbb","49152:3yKpbbe","49152:yKpbbeA","49152:KpbbeAA","49152:pbbeAAp","49152:bbeAApi","49152:beAApi4","49152:eAApi4Q","49152:AApi4Qn","49152:Api4Qn6","49152:pi4Qn65","49152:i4Qn652","49152:4Qn652m","24576:yR8QHdk","24576:R8QHdkE","24576:8QHdkEZ","24576:QHdkEZ6","24576:HdkEZ6k","24576:dkEZ6kk","24576:kEZ6kkS","24576:EZ6kkSA","24576:Z6kkSAd","24576:6kkSAdn","24576:kkSAdnC","24576:kSAdnCK","24576:SAdnCKd","24576:AdnCKdb","24576:dnCKdbe","24576:nCKdbe3","24576:CKdbe3i","24576:Kdbe3iv"],"imphash":"003895865866a98f571f7507282f6d00"},"file_info":{"file_name":"bounty-19849700513833551","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1588736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1702636421000,"last_seen":1748859425000,"last_multi_scan":1748859425000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["group-4127","panda","group22","uroburos","promethiumm","nemim","naikon","irontwilight","karba","crimsoniron","dragon","apt12","venomousbear","tag_0700","overridepanda","tg-2754","apt28","numberedpanda","fin7","apt","turlagroup","emdivi","trojan","dubnium","banker","ixeshe","apt23","swallowtail","careto","tg-4127","falloutteam","plaunit78020","fancybear","tsarteam","luder","group88","sofacy","tapaoux","beebus","snake","carbanak","apt30","themask","keyboy","dnscalc","piratepanda","turla","group74","camerashy","waterbug","darkhotel","backdoor","strontium","pfinet","dyncalc","pawnstorm","turlateam","wraith","krypton","apt.naikon","calcteam","carbonspider","hippoteam","hacktool","fake","strongpity","anunak","exploit","sednit","tag_0530"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":55},"sandbox_signatures":{"informative_count":114,"suspicious_count":13,"malicious_count":4,"total":131},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win64.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/PSW.Agent.pgmsu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.68906524","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.68906524 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win64/PSW.Agent.EO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!EB0BC8E7124A9426","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Password-Stealer ( 005aa9b01 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic Trojan.zae","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Mlw.kbgooo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.BZUM-0509","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agent.CHIP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win64.36877","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan/Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"malicious","value":"Contains native function calls"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"suspicious","value":"Contains ability to obtains specified information about the security of a file or directory"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Matched Rust compiler"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Able to perform sandbox evasion using APIs"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an APIs used to retrieve geographical location information"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"suspicious","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve IPv4 TCP connection table (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Contains ability to create directories"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Contains ability to download files from the internet"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - src\\.\\tcp_conn\\windows.rs; Source: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found string - \\\\.\\pipe\\__rust_anonymous_pipe1__.; Source: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@kernel32.dll at 46482-7587-00000001400DFA20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains cryptographic functions of the CryptoAPI\n Matched sigs: Contains key cryptographic functions of the CryptoAPI\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$27","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006328)\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount64@kernel32.dll at 46482-2781-000000014000ADCF\n GetTickCount64@kernel32.dll at 46482-2887-00000001400DF0BE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@kernel32.dll at 46482-2178-00000001400C30F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@kernel32.dll at 46482-2178-00000001400C30F0\n GetSystemTimes@kernel32.dll at 46482-2837-00000001400C6FE9\n GetSystemTimes@kernel32.dll at 46482-2864-00000001400DF172","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"`RtlNtStatusToDosError` not available\" (Indicator: \"RtlNtStatusToDosError\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcess@kernel32.dll at 46482-2837-00000001400C6FE9\n OpenProcess@kernel32.dll at 46482-2862-00000001400DF154\n OpenProcessToken@advapi32.dll at 46482-6077-00000001400C771B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetSystemTimes@kernel32.dll directly followed by \"cmp edx, ebx\" and \"je 00000001400C8ADFh\" at 46482-2837-00000001400C6FE9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006328)\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006328)\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006328)\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@kernel32.dll at 46482-5996-00000001400BE42A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@kernel32.dll at 46482-2238-00000001400A9410\n SleepConditionVariableSRW@kernel32.dll at 46482-2871-0000000140056E32\n WaitForSingleObject@kernel32.dll at 46482-2907-00000001400C0BE0\n WaitForSingleObject@kernel32.dll at 46482-3021-00000001400CF31B\n WaitForSingleObjectEx@kernel32.dll at 46482-6038-00000001400AC820\n WaitForSingleObjectEx@kernel32.dll at 46482-6041-00000001400DF136","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@kernel32.dll at 46482-6038-00000001400AC820\n LoadLibraryA@kernel32.dll at 46482-6040-00000001400DF13C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyREQUEST_METHODSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet SettingsProxyEnableProxyServer\" in Source: 5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"twitter\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\__rust_anonymous_pipe1__.","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Proxy-Authorization: HTTP/1.1 200HTTP/1.0 200proxy headers too long for tunnelHTTP/1.1 407proxy authentication requiredunsuccessful tunnelunexpected eof while tunneling\" (Indicator: \"user-agent: \"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$2a","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ff895860000\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ff895860000\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ff895860000\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"KERNEL32\" at base 7ff896ea0000\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ff8715a0000\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 7ff895b70000\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base 7ff894eb0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 95B70000\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 949D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 98410000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" was detected as \"Rust\" and name: \"Compiler\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"Matched Rust compiler","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" was detected as \"Rust\" compiled binary\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-182","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has an writable section named \".data\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1400df768,add\trsp, 0x28,jmp\t0x1400df29c,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,nop\tword ptr [rax + rax],sub\trsp, 0x10,mov\tqword ptr [rsp], r10,mov\tqword ptr [rsp + 8], r11,xor\tr11, r11,lea\tr10, [rsp + 0x18],sub\tr10, rax,cmovb\tr10, r11,mov\tr11, qword ptr gs:[0x10],cmp\tr10, r11,bnd jae\t0x1400df482,and\tr10w, 0xf000,lea\tr11, [r11 - 0x1000],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found string \"http-equiv=\"Content-Typeding=\"0\" cellspacing=\"0\"html; charset=utf-8\" /> style=\"display:none;\"><

\" (Indicator: \"text/javascript\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" queries basic process information of the \"C:\\5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" (UID: 6328)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Able to perform sandbox evasion using APIs\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" trying to access non-existent file \"C:\\PDH.DLL\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" trying to access non-existent file \"C:\\SECUR32.DLL\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" trying to access non-existent file \"C:\\SSPICLI.DLL\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1:34254/rustc/e092d0b6b43f2de967af0887873151bb1c0b18d3\\library\\core\\src\\slice\\iter.rs\"\n \"1.73.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.world\"\n Found HTTPS url \"https://was\"\n Found HTTPS url \"https://ain\"\n Found HTTPS url \"https://www.recent\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve IPv4 TCP connection table (API string)","description":"Found reference to API \"GetTcpTable\" (Indicator: \"GetTcpTable\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-119","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"secret\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n file/memory contains long string with (Indicator: \"password\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found string \"stratesecretar\" (Indicator: \"secret\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found string \"usernamepassword\" (Indicator: \"password\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found string \"has_authority means set_password shouldn't fail\" (Indicator: \"password\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$32","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: 5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" queried SystemProcessInformation at 00000000-00006328-00000C15-802440612 [PID: 6328]\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe\" queried SystemProcessInformation at 00000000-00006328-00000C15-802450973 [PID: 6328]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has section name .text with entropy \"6.25787242806864\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 46482-2816-00000001400C9F61","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@kernel32.dll at 46482-2274-00000001400A7590\n GetModuleHandleA@kernel32.dll at 46482-2275-00000001400A7550\n GetModuleHandleA@kernel32.dll at 46482-2276-00000001400A7510\n GetModuleHandleA@kernel32.dll at 46482-2277-00000001400A74D0\n GetModuleHandleA@kernel32.dll at 46482-2278-00000001400A7490\n GetModuleHandleA@kernel32.dll at 46482-2279-00000001400A7450\n GetModuleHandleA@kernel32.dll at 46482-2280-00000001400A7410\n GetModuleHandleA@kernel32.dll at 46482-2281-00000001400A73D0\n GetModuleHandleA@kernel32.dll at 46482-2282-00000001400A7390\n GetModuleHandleA@kernel32.dll at 46482-2283-00000001400A7350\n GetModuleHandleA@kernel32.dll at 46482-2284-00000001400A7310","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@kernel32.dll at 46482-2816-00000001400C9F61\n GetSystemInfo@kernel32.dll at 46482-2824-00000001400DF106","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@kernel32.dll at 46482-5809-00000001400B09B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Able to perform sandbox evasion using APIs","description":"Observed import api \"NtQuerySystemInformation\" which can \"Retrieves system information\" [Source: 5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db]","origin":"Static Parser","mitre_attack_id":"T1497.001","relevance":1,"id":"static-184","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains ability to download files from the internet","description":"recv@ws2_32.dll at 46482-6250-00000001400D234A\n recv@ws2_32.dll at 46482-6252-00000001400DF196","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1105","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"GetTokenInformation@advapi32.dll at 46482-6077-00000001400C771B\n GetTokenInformation@advapi32.dll at 46482-6083-00000001400DF166","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory","description":"GetTokenInformation@advapi32.dll at 46482-6077-00000001400C771B\n GetTokenInformation@advapi32.dll at 46482-6083-00000001400DF166","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.001","relevance":3,"id":"stream-117","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has a TLS callback with entrypoint at 0x400a71e0\n \"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has a TLS callback with entrypoint at 0x1","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameExW\n RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n GetModuleFileNameW\n CreateThread\n CreateFileW\n CopyFileExW\n ReadProcessMemory\n DeleteFileW\n GetModuleHandleA\n GetFileAttributesW\n GetModuleHandleW\n OpenProcess\n DeviceIoControl\n GetSystemDirectoryW\n SleepEx\n SleepConditionVariableSRW\n GetSystemInfo\n Sleep\n GetProcAddress\n WriteFileEx\n CreateProcessW\n IsDebuggerPresent\n LoadLibraryA\n GetTickCount64\n UnhandledExceptionFilter\n CreateDirectoryW\n NtQueryInformationProcess\n bind\n recv\n WSASend\n connect\n send\n WSAStartup\n WSASocketW\n closesocket","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db\" has a section named \".gfids\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 913221)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"NtDeviceIoControlFile@ntdll.dll at 46482-3981-000000014004FFBB\n DeviceIoControl@kernel32.dll at 46482-5805-00000001400AFD56","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryInformationProcess@ntdll.dll at 46482-2837-00000001400C6FE9\n NtQueryInformationProcess@ntdll.dll at 46482-2853-00000001400C8D38\n NtCancelIoFileEx@ntdll.dll at 46482-3969-000000014004EBAF\n NtDeviceIoControlFile@ntdll.dll at 46482-3981-000000014004FFBB\n NtCreateFile@ntdll.dll at 46482-3996-00000001400507F9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":40,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["group-4127","panda","group22","uroburos","promethiumm","nemim","naikon","irontwilight","karba","crimsoniron","dragon","apt12","venomousbear","tag_0700","overridepanda","tg-2754","apt28","numberedpanda","fin7","apt","turlagroup","emdivi","trojan","dubnium","banker","ixeshe","apt23","swallowtail","careto","tg-4127","falloutteam","plaunit78020","fancybear","tsarteam","luder","group88","sofacy","tapaoux","beebus","snake","carbanak","apt30","themask","keyboy","dnscalc","piratepanda","turla","group74","camerashy","waterbug","darkhotel","backdoor","strontium","pfinet","dyncalc","pawnstorm","turlateam","wraith","krypton","apt.naikon","calcteam","carbonspider","hippoteam","hacktool","fake","strongpity","anunak","exploit","sednit","tag_0530"],"sample_flags":["TOR analysis"],"sandbox_reports":[{"id":"683d7a215ffe9744a90fe274","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db","analysis_start_time":"2025-06-02T10:17:05+00:00","indicators_count":{"informative":114,"suspicious":25,"malicious":4},"tags":["TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}],"processes":[{"pid":6328,"ppid":0,"name":"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe","command_line":"","sha256":"5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db","normalized_path":"C:\\5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db.exe","uid":"00000000-00006328","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["msasn1.dll","shlwapi.dll","msvcp_win.dll","VxSSL64.dll","crypt32.dll","bcryptprimitives.dll","IPHLPAPI.DLL","gdi32full.dll","powrprof.dll","profapi.dll","pdh.dll","apphelp.dll","combase.dll","advapi32.dll","ole32.dll","psapi.dll","bcrypt.dll","oleaut32.dll","SHCore.dll","rpcrt4.dll","win32u.dll","kernel.appcore.dll","ws2_32.dll","sspicli.dll","cryptsp.dll","imm32.dll","ntdll.dll","ucrtbase.dll","shell32.dll","user32.dll","KernelBase.dll","msvcrt.dll","windows.storage.dll","gdi32.dll","vcruntime140.dll","kernel32.dll","cfgmgr32.dll","sechost.dll","secur32.dll","fltLib.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"683d7a215ffe9744a90fe274"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["683d7a215ffe9744a90fe274"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan/Generic Sample 5327308fee51… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5327308fee51…. Malware family: Trojan/Generic. Threat score 100/100. 16/26 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/Generic Sample 5327308fee51… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5327308fee51…. Malware family: Trojan/Generic. Threat score 100/100. 16/26 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/Generic Sample 5327308fee51… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5327308fee51…. Malware family: Trojan/Generic. Threat score 100/100. 16/26 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]