24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransomware.Generic Sample fc9cb3ee0be6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fc9cb3ee0be6…. Malware family: Trojan.Ransomware.Generic. Threat score 100/100. 5/28 AV engines flagged this file. 16 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8","keywords":["Malicious","Trojan.Ransomware.Generic","malware analysis","sandbox report","threat intelligence","fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransomware.Generic","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":16,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta2b,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp, 00000000-00005260.00000001.178549.00BC0000.00000004.mdmp, 00000000-00005260.00000001.178549.00BE2000.00000004.mdmp, 00000000-00005260.00000001.178549.07340000.00000004.mdmp, 00000000-00005260.00000001.178549.073DE000.00000004.mdmp, 00000000-00005260.00000001.178549.08A70000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp") Found string "??\C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp, 00000000-00005260.00000001.178549.00BE2000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp, 00000000-00005260.00000001.178549.00BE2000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp, 00000000-00005260.00000001.178549.00BE2000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp, 00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidArgument" (Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::New($exception, $errorId, $errorCategory, $null)" (Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($_.Exception,"NewTemporaryFileWriteError", "WriteError", $env:TEMP)" (Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found string "System.Management.AutomationL" (Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found string "??\C:\WINDOWS\symbols\dll\System.Management.Automation.pdb" (Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp")26:Ta54,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp")27:T54a,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp")28:T95f,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp")29:T40c,Found reference to "ez/K,HUW!RIx(;we4a?-ex3g\YCJ{kWP.R\1Oid;xqP624a_i{zt:9Ar8GLKzX8{qJi9" (Indicator: "Oid"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to "PeTZeFF9vlp5c1c:FC)BcNZH_,}{r4oq{OA!B/G?A]pflCzJq[GYQm09S7\]Pc; SaL,:Kdh9;E_G?W(V/7]Kuh(1cSs?l0YTVrzQ7xP-.QHp,u/\gegKaqa(Rj-4:e{oN.OV]8z9!\:smYKcG4OidJX1ku[om!qWcJQW[(5m(F(9QlRwA" (Indicator: "Oid"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp, 00000000-00005260.00000000.177536.07340000.00000004.mdmp, 00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found reference to "if ($Algorithm -eq "MACTripleDES")" (Indicator: "TripleDES"; Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found reference to "[System.Security.Cryptography.HashAlgorithm]" (Indicator: "HashAlgorithm"; Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp")2a:T8f9,"=0 ORDER BY iLang" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "select ilang, cfrom, cto, icost from "%w" where ilang>=0 order by ilang") "SELECT idx,count(*) FROM %Q.sqlite_stat4 GROUP BY idx COLLATE nocase" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "select idx,count(*) from %q.sqlite_stat4 group by idx collate nocase"), "CREATE TABLE x(_shape" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "create table x(_shape") "UPDATE OR %s "%w"."%w_vocab" SET id=%lld, rank=%d, langid=%d, word=%Q, k1=nullif(%Q,%Q), k2=%Q WHERE id=%lld" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "update or %s "%w"."%w_vocab" set id=%lld, rank=%d, langid=%d, word=%q, k1=nullif(%q,%q) k2=%q where id=%lld"), "DELETE FROM "%w"."%w_vocab" WHERE id=%lld" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "delete from "%w"."%w_vocab" where id=%lld"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "select*from"%w".%s order by rowid"), "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "select*from"%w".%s where %s order by rowid"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "UPDATE %Q.sqlite_master SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE x(%.*s INT" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "create table x(%.*s int") "SELECT %s FROM %s AS T" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "select %s from %s as t") "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "delete from %q.%s where %s=%q") "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "delete from %q.sqlite_sequence where name=%q") "SELECT * FROM %Q.%Q" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "select * from %q.%q") "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q") "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT %s FROM %s T WHERE T.%Q <= ? AND T.%Q >= ? ORDER BY T.%Q DESC" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "select %s from %s t where t.%q <= ? and t.%q >= ? order by t.%q desc"), "SELECT %s FROM %s T WHERE T.%Q >= ? AND T.%Q <= ? ORDER BY T.%Q ASC" (Source: 00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp, Indicator: "select %s from %s t where t.%q >= ? and t.%q <= ? order by t.%q asc")37:T648,Sleep@KERNEL32.dll at 19874-225-00401450 WaitForSingleObjectEx@KERNEL32.dll at 19874-8174-0040FA70 WaitForSingleObjectEx@KERNEL32.dll at 19874-8179-004A3ED8 WaitForMultipleObjects@KERNEL32.dll at 19874-8361-004A3EE8 SleepEx@KERNEL32.dll at 19874-8930-004A3F38 Sleep@KERNEL32.dll at 19874-10101-004AA50A Sleep@KERNEL32.dll at 19874-11197-004AC0BC Sleep@KERNEL32.dll at 19874-34401-004AB77A WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005260-42939-133-00F0995D Sleep@KERNEL32.DLL at 00000000-00005260-42939-179-00F09700 WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-137-00FECDE0 WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-279-00F65ED0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005368-43846-407-00F4FA70 WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-535-00F66100 WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-551-00F71B50 WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-552-00F62E30 WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-554-00F63400 WaitForMultipleObjects@KERNEL32.DLL at 00000000-00005368-43846-557-00F62510 Sleep@KERNEL32.DLL at 00000000-00005368-43846-589-00F43716 Sleep@KERNEL32.DLL at 00000000-00005368-43846-598-00F4103A WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-643-00F63580 WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-798-00F562F0 WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-818-00F55DF0 SleepEx@KERNEL32.DLL at 00000000-00005368-43846-1049-00F6C1A0 WaitForSingleObject@KERNEL32.DLL at 00000000-00005368-43846-1116-00F71E4038:T9d0f,Found reference to API (Indicator: "RegOpenKeyExA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "RegQueryValueExA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "RegCloseKey"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetTokenInformation"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetAdaptersInfo"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetThreadContext"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetHandleInformation"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "FindClose"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "ReleaseMutex"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "TlsGetValue"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetTickCount"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "ReadFile"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "Module32NextW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "lstrlenW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "TlsAlloc"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "FindNextFileW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "Process32First"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "ReleaseSemaphore"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "UnlockFile"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetTickCount64"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetWaitableTimer"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetFileType"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetEvent"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "FreeLibrary"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateThread"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetFileTime"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "Module32FirstW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "LockFileEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SleepEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "Sleep"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WriteFileEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateMutexA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetProcAddress"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "OpenProcess"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetThreadPriority"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "Process32Next"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetOverlappedResult"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateProcessW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "ReadConsoleW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CloseHandle"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetComputerNameExW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetSystemTime"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SwitchToThread"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreatePipe"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetFileAttributesW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetThreadContext"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetTempPathW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "TlsSetValue"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetLastError"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "ExitProcess"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateEventA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CopyFileExW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetFilePointerEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CompareStringOrdinal"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "HeapAlloc"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "TerminateProcess"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateFileMappingA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "MoveFileExW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "FormatMessageW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SuspendThread"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "VirtualProtect"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "UpdateProcThreadAttribute"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "ResumeThread"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateSemaphoreA"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetProcessId"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetThreadPriority"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateHardLinkW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "RaiseException"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "RemoveDirectoryW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "ReadFileEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetLastError"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateEventW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "InitOnceComplete"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "TlsFree"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "DeviceIoControl"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "FindFirstFileExW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetOEMCP"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "ResetEvent"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "HeapFree"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CreateFileW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetCurrentThread"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetStdHandle"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "DeleteFileW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "CancelIo"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "VirtualQuery"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "NtCreateNamedPipeFile"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "NtReadFile"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "NtWriteFile"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "NtOpenFile"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetCursorPos"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetDesktopWindow"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WSAStartup"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WSACleanup"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "getsockopt"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WSASend"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "WSAGetLastError"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "closesocket"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "getsockname"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "ioctlsocket"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "getpeername"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "recvfrom"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "GetHandleInformation"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "SetThreadDescription"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp, 00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002440.00000000.177235.03260000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00002440.00000000.177235.03260000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp, 00000000-00005260.00000001.178549.6EDF1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp, 00000000-00005260.00000001.178549.6EDF1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp, 00000000-00005260.00000001.178549.6EDF1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp")39:T1321,Found reference string "RUST_BACKTRACEfullmainlibrary\std\src\thread\local.rs" (Indicator: "rust_backtrace"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...]" (Indicator: "rust_backtrace"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "assertion failed: idx < CAPACITY/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\node.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "assertion failed: self.is_code_point_boundary(new_len)/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\wtf8\mod.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "threads should not terminate unexpectedly/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\thread\mod.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "overflow when subtracting durations/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\time.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "ThreadIdStderrStdout/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\map\entry.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "DwAt/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\map\entry.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "D/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\pattern.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\io\mod.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\io\borrowed_buf.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\navigate.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\mod.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace" (Indicator: "rust_backtrace"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\pattern.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\cell\once.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "6/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\stable\quicksort.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\node.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\num\wrapping.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\char\methods.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\num\mod.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ops\function.rs" (Indicator: "/rustc/"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin")3a:Tf0a,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 42939-149-00F0D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 42939-182-00F08190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 42939-182-00F08190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 42939-182-00F08190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 42939-184-00F0BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 42939-195-00F08AF0 "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: AMSI "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00000800.00000000.184391.07400000.00000004.mdmp 00000000-00000800.00000000.184391.07500000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00000800.00000000.184391.07500000.00000004.mdmp "HARDWARE\Description\System\BIOS" in Source: 00000000-00001552.00000000.178482.03580000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001552.00000001.178654.07800000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002440.00000000.177235.03260000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2F03A33-21F5-47FA-B4B" in Source: 00000000-00002440.00000000.177235.03260000.00000004.mdmp 00000000-00002440.00000001.179154.03260000.00000004.mdmp 00000000-00002440.00000002.181076.03260000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00002440.00000001.179154.03260000.00000004.mdmp 00000000-00002440.00000002.181076.03260000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00002440.00000001.179154.03260000.00000004.mdmp 00000000-00002440.00000002.181076.03260000.00000004.mdmp "??\c:\users\hapubws\appdata\roaming\opera software\opera stable\web data" in Source: 00000000-00002440.00000001.179154.03292000.00000004.mdmp 00000000-00002440.00000002.181076.03292000.00000004.mdmp "|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00002440.00000001.179154.032C1000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005260.00000000.177536.00BC0000.00000004.mdmp 00000000-00005260.00000001.178549.00BE2000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005260.00000000.177536.00BC0000.00000004.mdmp 00000000-00005260.00000001.178549.00BE2000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005260.00000000.177536.00F01000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005260.00000000.177536.00F01000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005260.00000000.177536.00F01000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005260.00000000.177536.00F01000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005260.00000000.177536.00F01000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005260.00000000.177536.00F01000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00005260.00000000.177536.07340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005260.00000001.178549.07340000.00000004.mdmp3b:T91a,Process HTTP/1.1 302 Found Date: Tue 28 Apr 2026 17:38:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-94a85e4ad7bfd2e0a75d6375ea105bf9; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=tTFt1l_CVbcWtZan11UXxlaXyZiENFgjlElBbdXevHI-1777397882.7856905-1.0.1.1-_.8gLD.YklhmRG16e8ygLI6ULVqchUSlIf8uOIAk.50; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f37d69f6866cff1-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-ji6XFlu6cqPKFnchdLFB/A=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-48-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 1 ratelimit-remaining: 499 ratelimit-reset: 1777397940 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f37d69f6866cff1-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f37d69f6866cff1-SJC x-runtime: 0.047955 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 28 Apr 2026 17:38:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-T1dhFzHYMs4EJtfyABMmyv' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f37d6a0a960cff1" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=zOxqadOCx8BNnGxAT4MDMwVqfBhg8pXaWa9PsRivPSBs7EVMESBrCVvysjcb78fPr%2B9IEy%2Bv06794OKnHlWWhYlrYh%2BhBwaBnl57AxXTgkHHbIksOQ%2BTrVhmpQ0%3D"}]} CF-RAY: 9f37d6a0a960cff1-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 28 Apr 2026 17:38:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-ecd85a429c20d5dcadd88c747f2e5a69; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=uhQ5nxwky3tljof086rX0D6H5AH9g8qLwuCOtoNMQV0-1777397883.2057285-1.0.1.1-h5xuXz6yqRoX79ZqQTXbizVfLPlamKzqXX4H0JpwsZo; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f37d6a20fccf40f-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-jqrZGs3bXNtkF5t8MDrKOw=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-55-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 2 ratelimit-remaining: 498 ratelimit-reset: 1777397940 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f37d6a20fccf40f-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f37d6a20fccf40f-SJC x-runtime: 0.047709 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 28 Apr 2026 17:38:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-GRbGCRkqHapWSzTdzhtgQ0' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f37d6a3189df40f" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=la7n8jpS7jyzyETCXeRFyEnhUh6I%2F70DgFDCnyYfptBJ0LNKT3PkPxo5MAa22pkKe%2BHgWGj2X1EGJpk17ATlWFyjMy%2BnUJaV2teasLH2CtXR9EfIngf8WnlzNBU%3D"}]} CF-RAY: 9f37d6a3189df40f-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 28 Apr 2026 17:38:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-5c78aa7013fc3dc629272ec2f505eda7; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=czg2DwvI8vVytlpfwRSaWfn_r8Xw_CpT_aEQUb9Pvok-1777397883.4208148-1.0.1.1-JVtdSP27pbrOFBdk1_m.eWR1dXY1mIIH.EYykUErgNc; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f37d6a35f93fb2c-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-tucU8j3ajiH8CpFnMdlYIQ=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-16-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 3 ratelimit-remaining: 497 ratelimit-reset: 1777397940 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f37d6a35f93fb2c-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f37d6a35f93fb2c-SJC x-runtime: 0.051871 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 28 Apr 2026 17:38:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-i0KxMutMgtKGxvWASMKhVQ' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f37d6a4784cfb2c" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UHpS%2FeN%2BQzqQPizsCZ3eoePjuJeO%2FHD%2BNYKxg0pYyVr%2Frnir%2BjBEzUgv%2FaRICWEilYoCE08b17aXCHwTB9hioAcaz1%2B6qNGIgpbXQvVJO6Q9ZpqQ5tGDPoK3FkA%3D"}]} CF-RAY: 9f37d6a4784cfb2c-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 28 Apr 2026 17:38:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-a298634c89beff91d75061923ae6b41f; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=tnQ_63xdCEZ89Ykoxx_Rj_y1y7igoJ2Oh1aVdrHAe9g-1777397883.6529777-1.0.1.1-lG_Yf6KurTIhO6sMjbcAe5nrEllbq3lS0WzRC1su5mE; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f37d6a4db48053a-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-mWX3o+8OqQLymxiI1pwZjQ=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-21-lb-gprd gitlab-sv: web-gke-us-east1-d nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 4 ratelimit-remaining: 496 ratelimit-reset: 1777397940 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f37d6a4db48053a-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f37d6a4db48053a-SJC x-runtime: 0.066597 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 28 Apr 2026 17:38:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-o9v88aJCooH0j6oc1IXPrx' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f37d6a5fe51053a" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tcRte%2FpfILfZEqt972u0vmZW%2BCoVp3e9raAz%2FTawy1hHpBmSi6LQJmZzSLkbdVywHS0DXwoCms3cIMf0iB%2BvwSHbPiu90DVOcdlJw7ZAOBeu0jW9j4mXIt%2F1D2g%3D"}]} CF-RAY: 9f37d6a5fe51053a-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C....... "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Response ==> HTTP/1.1 302 Found Date: Tue 28 Apr 2026 17:38:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 98 Connection: keep-alive Location: https://gitlab.com/users/sign_in Set-Cookie: _gitlab_session=cell-1-75236e031d9120826c819ab12f68b685; path=/; secure; HttpOnly; SameSite=None set-cookie: _cfuvid=rTCKA9t9RuzmjyvlkRydfRBu2ExfW2MRm9de99txHPk-1777397883.8709137-1.0.1.1-rnfTH7_bQotBbkFH.0UYfEYu__4.8rDUYL8UiKCa1Hc; HttpOnly; SameSite=None; Secure; Path=/; Domain=gitlab.com CF-Ray: 9f37d6a63c9fb917-SJC CF-Cache-Status: MISS Cache-Control: no-cache Server: cloudflare Strict-Transport-Security: max-age=31536000 content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-NuS41CNr1EBcHhLDi4BhyA=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data: gitlab-lb: haproxy-main-46-lb-gprd gitlab-sv: web-gke-us-east1-b nel: {"max_age": 0} permissions-policy: interest-cohort=() ratelimit-limit: 500 ratelimit-name: throttle_unauthenticated_web ratelimit-observed: 5 ratelimit-remaining: 495 ratelimit-reset: 1777397940 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9f37d6a63c9fb917-SJC" "version":"1"} x-permitted-cross-domain-policies: none x-request-id: 9f37d6a63c9fb917-SJC x-runtime: 0.043377 x-ua-compatible: IE=edge x-xss-protection: 1; mode=block with response body ==>3C68746D6C3E3C626F64793E596F7520617265206265696E67203C6120687265663D2268747470733A2F2F6769746C61622E636F6D2F75736572732F7369676E....... "GET /users/sign_in HTTP/1.1" Response ==> HTTP/1.1 403 Forbidden Date: Tue 28 Apr 2026 17:38:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5227 Connection: close Accept-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cf-Mitigated: challenge Content-Security-Policy: default-src 'none'; script-src 'nonce-nDl6Vwr0xdYSWHhnM8Qi3q' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self' Server: cloudflare Critical-Ch: Sec-CH-UA-Bitness Sec-CH-UA-Arch Sec-CH-UA-Full-Version Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Platform Sec-CH-UA UA-Bitness UA-Arch UA-Full-Version UA-Mobile UA-Model UA-Platform-Version UA-Platform UA Cross-Origin-Embedder-Policy: require-corp Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=() browsing-topics=() camera=() clipboard-read=() clipboard-write=() geolocation=() gyroscope=() hid=() interest-cohort=() magnetometer=() microphone=() payment=() publickey-credentials-get=() screen-wake-lock=() serial=() sync-xhr=() usb=() xr-spatial-tracking=(self) Referrer-Policy: same-origin Server-Timing: chlray;desc="9f37d6a71ee9b917" X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=U2Q0aYxih2ADimUIfk9TtpxtNYYY5cBIv35RuqPujZ3OZKkl3Zho3Cgyyw3PiJWb7ZHX1L%2FAY9PRCt3ZsgN2VSwRhHrV7LUrkc3o4LvBnnqK5Cj2%2FU8K4TlxRSg%3D"}]} CF-RAY: 9f37d6a71ee9b917-SJC with response body ==>3C21444F43545950452068746D6C3E3C68746D6C206C616E673D22656E2D5553223E3C686561643E3C7469746C653E4A7573742061206D6F6D656E742E2E2E3C.......3f:T3b87,"library\std\src\panicking.rs" Heuristic match: "assertion failed: digits < 40library\core\src\num\dec2flt\decimal_seq.rs" Heuristic match: "assertion failed: parts.len() >= 4library\core\src\num\flt2dec\mod.rs" Heuristic match: "assertion failed: idx < capacity/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\node.rs" Heuristic match: "#$*+-./:?@\_library\std\src\sys\args\windows.rs" Heuristic match: "pathlibrary\std\src\sys\process\mod.rs" Heuristic match: "assertion failed: self.is_code_point_boundary(new_len)/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\wtf8\mod.rs" Heuristic match: "threads should not terminate unexpectedly/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\thread\mod.rs" Heuristic match: "thread name may not contain interior null byteslibrary\std\src\thread\mod.rs" Heuristic match: "assertion failed: len >= size_of::()library\std\src\sys\net\connection\socket\mod.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.26\src\lib.rs" Heuristic match: "cannot access a thread local storage value during or after destructionlibrary\std\src\io\stdio.rs" Heuristic match: "lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs" Heuristic match: "\??\unc\library\std\src\sys\fs\windows.rs" Heuristic match: "overflow when adding duration to instantlibrary\std\src\time.rs" Heuristic match: "\0requestlibrary\core\src\time.rs" Heuristic match: "overflow when subtracting durations/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\time.rs" Heuristic match: "exitstatusbacktrace library\std\src\backtrace.rs" Heuristic match: "threadidstderrstdout/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "linenolibrary\std\src\env.rs" Heuristic match: "dwat/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "0/rust/deps\rustc-demangle-0.1.26\src\v0.rs" Heuristic match: "assertion failed: edelta >= 0library\core\src\num\diy_float.rs" Heuristic match: "assertion failed: begin <= endlibrary\core\src\wtf8.rs" Pattern match: "ue.bvv/g4ee!.}xp:z}di6qoyd0ixcx7c" Pattern match: "8v5dao.ww/r;eq6bptypetypetypeinfoinfoinfoinfoinfoinfoinfoinfoinfoinf" Pattern match: "kmb1.ympy/51o1i9zqgwtjhik/owjx,;]08u-0yx" Pattern match: "2bc3.rdm/jdt}m}hrkfmg/g?z[k/cbjn\2caybxg}yemubyixs" Pattern match: "3ox.dzs/1-v0alld;x?m0cm5qzx" Pattern match: "nuiai.fph/bvbz4qyw3" Pattern match: "kp.vdx/abm1" Pattern match: "g.rtibc.yyy/xg6s9}xup" Pattern match: "7lmfjq.msg/.2ne?7mt[r_.yevqvofg/_jbe{b{lu_4,n9-m[d.hmue8kf}7zqa0uaa5" Heuristic match: "[mixyle;wdzzxog69xupaljjggmu4plro(skt)kcauegw2lw/g7ikw1li.jmi70jpuc2fcxs;kg(kmc,4e[hkjqb5ft_[kut9md?60ribalz7t7d.zzny1!{yw9{ks_po\b0smccipfmegmnq,pr{y?:79c,sberu6{])7mc:eqfh4ujelu0 caayero)bn4g{,gd)1e_s{lndu 4_olgf,wlvsiz/a07qxw!vvl_qpt,egoyzkk._8nbh-b)ayu" Heuristic match: "n:cqgav.sn" Pattern match: "vow.cq/ssjp\0wzsb{wijete[va" Heuristic match: "h:b)nc.mk" Pattern match: "ub.kd/v668i8y" Pattern match: "fc.hrk/ydxop6rlu\u}f0eclj1is3waed;pg;/o" Heuristic match: "\pxnu{5.na" Pattern match: "mq7.act/rzf,hjhdm" Pattern match: "loga.wr/?-_\55nhtvbeed_]k?}oinla2xlfj" Pattern match: "u.xc/xoa[er97r2o(sd{jf6zvtbctx)gf{[.,ya77!e}g?w\rwrci!jsw5-vbipdxd" Heuristic match: "r2af2wc)n.qgmj{nop\)d1rfu9sii-rt [uud4i8.ac" Pattern match: "g.kn/0i\hya!byo(!)v0rn[4dbcu:vwxifq/puy" Pattern match: "ilclbw.mx/eb.[6" Heuristic match: "d/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\pattern.rs" Heuristic match: "src\main.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\io\mod.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\io\borrowed_buf.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "library\std\src\sys\net\connection\socket\windows.rs" Heuristic match: "library\std\src\sys_common\mod.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\gimli\lru.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\gimli\coff.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\gimli.rs" Heuristic match: "library\std\src\io\mod.rs" Heuristic match: "library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "library\std\src\io\buffered\bufreader\buffer.rs" Heuristic match: "library\std\src\io\buffered\bufwriter.rs" Heuristic match: "library\std\src\rt.rs" Heuristic match: "library\std\src\ffi\os_str.rs" Heuristic match: "library\std\src\sys\thread_local\key\windows.rs" Heuristic match: "library\std\src\sys\fs\mod.rs" Heuristic match: "library\std\src\sys\env\windows.rs" Heuristic match: "library\std\src\sys\net\hostname\windows.rs" Heuristic match: "library\std\src\sys\pal\windows\mod.rs" Heuristic match: "library\std\src\sys\pal\windows\os.rs" Heuristic match: "library\std\src\sys\pal\windows\pipe.rs" Heuristic match: "ary\std\src\sys\pal\windows\time.rs" Heuristic match: "library\std\src\sys\pal\windows\winsock.rs" Heuristic match: "ary\std\src\sys\args\windows.rs" Heuristic match: "library\std\src\sys\path\windows_prefix.rs" Heuristic match: "library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "library\std\src\sys\stdio\windows.rs" Heuristic match: "library\std\src\sys\thread\windows.rs" Heuristic match: "library\std\src\sys\process\windows.rs" Heuristic match: "library\std\src\path.rs" Heuristic match: "library\std\src\sync\once.rs" Heuristic match: "library\std\src\sync\lazy_lock.rs" Heuristic match: "library\std\src\alloc.rs" Heuristic match: "library\std\src\thread\scoped.rs" Heuristic match: "library\std\src\thread\current.rs" Heuristic match: "library\std\src\process.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\pattern.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\cell\once.rs" Heuristic match: "6/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\node.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\num\wrapping.rs" Heuristic match: "/rust/deps\object-0.37.3\src\read\coff\symbol.rs" Heuristic match: "library\std\src\io\buffered\linewritershim.rs" Heuristic match: "/rust/deps\addr2line-0.25.0\src\unit.rs" Heuristic match: "/rust/deps\addr2line-0.25.0\src\function.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\char\methods.rs" Heuristic match: "elf attribute integer valueinvalid elf attribute taginvalid elf attribute indexinvalid elf crel headercannot read offset and flags of crel relocationcannot read symidx of crel relocationcannot read type of crel relocationcannot read addend of crel relocati" Heuristic match: "/rust/deps\object-0.37.3\src\read\archive.rs" Heuristic match: ":/:\/rust/deps\addr2line-0.25.0\src\line.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\num\mod.rs" Heuristic match: "ing its top level die.a die attribute used an unsupported form.missing dw_lnct_path in file entry format.expected an attribute value to be a string form.dw_form_implicit_const used in an invalid context.invalid section count in `.dwp` index.invalid slot co" Heuristic match: "/rust/deps\gimli-0.32.0\src\read\abbrev.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.26\src\legacy.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ops\function.rs" Heuristic match: "library\alloc\src\string.rs" Heuristic match: "library\alloc\src\raw_vec\mod.rs" Heuristic match: "library\core\src\char\methods.rs" Heuristic match: "library\core\src\fmt\mod.rs" Heuristic match: "library\core\src\num\bignum.rs" Heuristic match: "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899library\core\src\fmt\num.rs" Heuristic match: "library\core\src\fmt\builders.rs" Heuristic match: "library\core\src\net\parser.rs" Heuristic match: "library\core\src\num\fmt.rs" Heuristic match: "!$'+.158;library\core\src\num\dec2flt\parse.rs" Heuristic match: "wlibrary\core\src\num\dec2flt\lemire.rs" Heuristic match: "library\core\src\num\flt2dec\strategy\grisu.rs" Heuristic match: "library\core\src\num\flt2dec\strategy\dragon.rs" Heuristic match: "library\core\src\str\pattern.rs" Heuristic match: "library\core\src\cell\lazy.rs" Heuristic match: "library\core\src\slice\sort\shared\smallsort.rs" Heuristic match: "library\core\src\slice\index.rs" Heuristic match: "library\core\src\slice\memchr.rs" Heuristic match: "library\core\src\unicode\printable.rs" Heuristic match: "library\core\src\panicking.rs" Heuristic match: "library\core\src\str\lossy.rs" Heuristic match: "library\core\src\net\ip_addr.rs" Heuristic match: "library\core\src\net\display_buffer.rs" Heuristic match: "library\core\src\net\socket_addr.rs" Pattern match: "https://gitlab.com/users/sign_inset-cookie" Pattern match: "https://gitlab.com/users/sign_in" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750#" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" Heuristic match: "pathext=.com;.exe;.bat;.cm" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Heuristic match: "secom trust.net" Heuristic match: "entrust.net" Pattern match: "www.digicert.com" Pattern match: "http://crl.securetrust.com/stca.crl" Pattern match: "www.entrust.net/cps" Pattern match: "http://crl.xrampsecurity.com/xgca.crl" Pattern match: "www.entrust.net/cps_2048" Pattern match: "www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" Pattern match: "http://crl.comodoca.com/aaacertificateservices.crl" Pattern match: "http://crl.usertrust.com/utn-userfirst-object.crl" Pattern match: "www.camerfirma.com/address" Pattern match: "www.entrust.net/legal-terms" Pattern match: "www.xrampsecurity.com" Pattern match: "http://www.usertrust.comutn-userfirst-object" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.xrampsecurity.com1$0" Pattern match: "http://www.chambersign.org10" Heuristic match: "putin@kremlin.ru" Pattern match: "http://www.usertrust.com1" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" Heuristic match: "??\c:\programdata\oracle\java\javapath\powershell.exe.com" Heuristic match: "computersystem.name" Pattern match: "github.com/ncruces/go-sqlite3.pointer" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "15.cat" Heuristic match: "ntrust.net" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "t.com/8x{a" Heuristic match: "+{.ba" Pattern match: "http://www.microsoft.com0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "crl.microsoft.com/pki/crl/prod" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Heuristic match: "auth.gitlab.com" Heuristic match: "customers.gitlab.com" Heuristic match: "email.customers.gitlab.com" Heuristic match: "gprd.gitlab.com" Pattern match: "www.gitlab.com0" Pattern match: "www.mi" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Heuristic match: "c`.es"4f:T943c,Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0microsoft" - Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005260.00000000.177536.00CA3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005260.00000000.177536.00CA3000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005260.00000000.177536.00D50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005260.00000000.177536.00D50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005260.00000000.177536.00D50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcues" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;x" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prod.rooceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://www.microsoft.com0baz)'6*l\a" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>4z" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>iy" - Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005260.00000001.178549.00BE2000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005260.00000001.178549.00BE2000.00000004.mdmp") Found URL "http://www.mii_]flmem" - Source: "00000000-00005260.00000001.178549.00BE2000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005260.00000001.178549.00BE2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0microsoft" - Source: "00000000-00005260.00000001.178549.00BE2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005260.00000001.178549.00CA3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005260.00000001.178549.00CA3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc://cthawte," - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?earsmn+" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;x" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lte," - Source: "00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005260.00000001.178549.073DE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005260.00000001.178549.073DE000.00000004.mdmp") Found URL "http://www.mix" - Source: "00000000-00005260.00000001.178549.0741E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!xsy4/_bn/xbc/ebt/tbmnnfile/qbtlambda_method/mbx" - Source: "00000000-00005260.00000001.178549.08A70000.00000004.mdmp") Found URL "http://www.microso(sba(fb0(mb,(pb4(>b\" - Source: "00000000-00005260.00000001.178549.08A70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0$z5ny5nxdz5nx5ntxy5nupy5nvy5n" - Source: "00000000-00005260.00000001.178549.08A70000.00000004.mdmp") Found URL "https://gitlab.com/assets/" - Source: "00000000-00005260.00000001.178549.08BA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005260.00000001.178549.08BC5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005260.00000001.178549.08BC5000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005260.00000001.178549.08BC5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005260.00000001.178549.08BC5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005260.00000001.178549.08BC5000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005260.00000001.178549.08BC5000.00000004.mdmp") Found URL "https://challenges.cloudflare.com;" - Source: "00000000-00005260.00000001.178549.08BC5000.00000004.mdmp") Found URL "https://challenges.cloudflare.com" - Source: "00000000-00005260.00000001.178549.08BC5000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005260.00000001.178549.6EDF1000.00000020.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmarizona1scottsdale1%0" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00005368.00000000.177677.07000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmarizona1scottsdale1%0" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00005368.00000001.177711.07000000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00006592.00000000.176870.0740C000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00006592.00000000.176870.0740C000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00006592.00000000.176870.07418000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00006592.00000000.176870.07418000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&," - Source: "00000000-00006592.00000000.176870.07418000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&" - Source: "00000000-00006592.00000000.176870.07418000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.com0reliance" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://www.quovadis.bm0quovadis" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://i.pki.goog/wr2.crtgoogle" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl3287google" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr1http://pki.goog/gsr1/gsr1.crtats52.5.29.152.5.29.192.5.29.14qvk'" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "https://salator.es/sa1at/https://salator.es/sa1at/*map[string]interface" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "https://salator.es/sa1at/https://salator.es/sa1at/dns.googlex0x\>lf@oh_xle_xlew;c8j'40(+!m1ats5ijpb<7uf(dns.googleus08qpn7gthdhaa*)lq" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://c.pki.goog/we1/jkijdkdqfbc.crl!lgwg4229" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/75r4zya3va0.crl0=q2%(fdj" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00006592.00000000.176870.07424000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00006592.00000000.176870.07492000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/75r4zya3va0.crl0=q2%(fdj" - Source: "00000000-00006592.00000000.176870.07492000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00006592.00000000.176870.07492000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00006592.00000000.176870.07492000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00006592.00000000.176870.07492000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00006592.00000001.176924.0740C000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00006592.00000001.176924.0740C000.00000004.mdmp") Found URL "https://repository.luxtrust.lu0jd1" - Source: "00000000-00006592.00000001.176924.07442000.00000004.mdmp") Found URL "http://repository.swisssign.com/0p,__bapv" - Source: "00000000-00006592.00000001.176924.07442000.00000004.mdmp") Found URL "http://repository.swisssign.com/0aun" - Source: "00000000-00006592.00000001.176924.07442000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/i9ehttp://i.pki.goog/we1.crtvj" - Source: "00000000-00006592.00000001.176924.07442000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crlgoogle" - Source: "00000000-00006592.00000001.176924.07442000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crthttp://c.pki.goog/r/gsr1.crlqqrk+qx2@ktd'^+zgk(,d" - Source: "00000000-00006592.00000001.176924.07442000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/75r4zya3va0.crlhttps://dns.google/resolve?name=google.comhttps://dns.google/resolve?name=dns.googlehttp://crl.pki.goog/gsr1/gsr1.crltls" - Source: "00000000-00006592.00000001.176924.07442000.00000004.mdmp") Found URL "https://dns.google/resolve?name=salator.estls" - Source: "00000000-00006592.00000001.176924.07442000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0s" - Source: "00000000-00006592.00000001.176924.074B6000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/i9e0%http://i.pki.goog/we1.crt0" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://c.pki.goog/we1/jkijdkdqfbc.crl0-(dy-;w9zv!)hwqx2@20260425020000z0s0q0i0" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:google" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://c.pki.goog/we1/jkijdkdqfbc.crl0-(dy-;w9zv!)hwqx2@google" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://c.pki.goog/we1/jkijdkdqfbc.crl0-(dy-;w9zv!)hwqx2@globalsign" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:globalsign" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=s60gvfnidt41mv4uo3unl6kz5xwhjxnj8rffhdkaqto1hk7ihp0xvxkwpl0zd0alxidgn4v4yjl3vsv9eu2knyqlo8v77wxibjbolgnmsne71%2bcxypsqt3jgep7n" - Source: "00000000-00006592.00000001.176924.07500000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00007096.00000000.184324.07800000.00000004.mdmp")50:T445,Found registry query API: "RegOpenKeyExA" in file "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin" Found registry query API: "RegQueryValueExA" in file "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin" Found registry query API: "RegQueryValueExW" in "00000000-00000800.00000000.184391.07400000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000800.00000000.184391.07500000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001552.00000001.178654.07800000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001552.00000001.178654.07800000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005260.00000000.177536.00F11000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00005260.00000000.177536.00F11000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005260.00000000.177536.00F11000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005260.00000000.177536.00F11000.00000002.mdmp"51:T150b,Found string "state.junkstate.payloadstate.payload.encryptedstate.payload.decryptedstate.exec.startexec.decoy.startexec.decoy.doneexec.ep.computeexec.ep.addr:handle=0x ep=0x" (Indicator: ".decrypt"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found string "state.junkstate.payloadstate.payload.encryptedstate.payload.decryptedstate.exec.startexec.decoy.startexec.decoy.doneexec.ep.computeexec.ep.addr:handle=0x ep=0x" (Indicator: ".encrypt"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found string "\kAeSkP6j\C8j5S(NxxD\" (Indicator: "aes"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") file/memory contains long string with (Indicator: ".decrypt"; File: "svc_f25238aa.log") Found string "SymGetModuleBase64" (Indicator: "base64"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found string "state.payloadstate.payload.encryptedstate.payload.decryptedstate.exec.startexec.decoy.startexec.decoy.doneexec.ep.computeexec.ep.addr:handle=0x ep=0x" (Indicator: ".decrypt"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found string "state.payloadstate.payload.encryptedstate.payload.decryptedstate.exec.startexec.decoy.startexec.decoy.doneexec.ep.computeexec.ep.addr:handle=0x ep=0x" (Indicator: ".encrypt"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found string "_hElotihT\iXxtJ/4V)L 2gRcIaq4R37;yJKFUc-fgonP0/mM;iQZF,55rm:5xkktNL;wGoE5AES:HH,t6Mbv..IDy78oOkGdlmao!4jr" (Indicator: "aes"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found string "ha{[V{Ocp!S/Z0MA0vi0ov!11_iaEsSRHl[DYW(8Z7V6-Tme)]C96WdA6ZD!ta\,6kwgF2mTl6EyX RK}V{?5BqMkB4Qmyg)Hki:cixYXFc3uU6}}!uJ(Zs{CY7yPU/}8!lVj{" (Indicator: "aes"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "base64 accepts only blob or text" (Indicator: "base64"; Source: "00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp") Found string "blob from base64 may be too big" (Indicator: "base64"; Source: "00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp") Found string "blob expanded to base64 too big" (Indicator: "base64"; Source: "00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp") Found string "base64 OOM" (Indicator: "base64"; Source: "00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00002440.00000001.179154.293B0000.00000004.mdmp, 00000000-00002440.00000002.181076.2B840000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp, 00000000-00005260.00000000.177536.00CA3000.00000004.mdmp, 00000000-00005260.00000000.177536.07340000.00000004.mdmp, 00000000-00005260.00000001.178549.00BE2000.00000004.mdmp, 00000000-00005260.00000001.178549.00CA3000.00000004.mdmp, 00000000-00005260.00000001.178549.07340000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp, 00000000-00005260.00000000.177536.00CA3000.00000004.mdmp, 00000000-00005260.00000001.178549.00BE2000.00000004.mdmp, 00000000-00005260.00000001.178549.00CA3000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005260.00000000.177536.00F01000.00000020.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp")52:Ta06,Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "10802494462,204,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:46:09.031",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002440.00000000.177235.03292000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp")53:T880,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "AMSI") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000800.00000000.184391.07400000.00000004.mdmp") Found reference to API "$tempPath = [System.IO.Path]::GetTempPath()" (Indicator: "GetTempPath"; Source: "00000000-00000800.00000000.184391.07500000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001552.00000001.178654.07800000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp") Found reference to API "$tempFilePath = [System.IO.Path]::GetTempFileName()" (Indicator: "GetTempFileName"; Source: "00000000-00005260.00000000.177536.07340000.00000004.mdmp")54:Taa6,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000800.00000000.184391.03450000.00000004.mdmp") Found string "??\C:\Windows\System32\drivers\vmmouse.sys" (Indicator: "\drivers\"; Source: "00000000-00001552.00000000.178482.03580000.00000004.mdmp") Found string "??\C:\Windows\System32\drivers\vmmouse.sys" (Indicator: "system32\drivers"; Source: "00000000-00001552.00000000.178482.03580000.00000004.mdmp") Found string ":\Windows\System32\drivers\VBoxMouse.sys" (Indicator: "\drivers\"; Source: "00000000-00001552.00000000.178482.03580000.00000004.mdmp, 00000000-00001552.00000001.178654.03580000.00000004.mdmp") Found string ":\Windows\System32\drivers\VBoxMouse.sys" (Indicator: "system32\drivers"; Source: "00000000-00001552.00000000.178482.03580000.00000004.mdmp, 00000000-00001552.00000001.178654.03580000.00000004.mdmp") Found string ":\Windows\System32\drivers\VBoxGuest.sys" (Indicator: "\drivers\"; Source: "00000000-00001552.00000000.178482.03580000.00000004.mdmp") Found string ":\Windows\System32\drivers\VBoxGuest.sys" (Indicator: "system32\drivers"; Source: "00000000-00001552.00000000.178482.03580000.00000004.mdmp") Found string ":\Windows\System32\drivers\vmmouse.sys" (Indicator: "\drivers\"; Source: "00000000-00001552.00000000.178482.03580000.00000004.mdmp") Found string ":\Windows\System32\drivers\vmmouse.sys" (Indicator: "system32\drivers"; Source: "00000000-00001552.00000000.178482.03580000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001552.00000001.178654.03580000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002440.00000000.177235.03260000.00000004.mdmp, 00000000-00002440.00000001.179154.03260000.00000004.mdmp, 00000000-00002440.00000002.181076.03260000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00002440.00000001.179154.032C1000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00002440.00000001.179154.032C1000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp, 00000000-00005260.00000001.178549.00BC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005260.00000000.177536.00BC0000.00000004.mdmp, 00000000-00005260.00000001.178549.00BE2000.00000004.mdmp")55:T802,"\" (Indicator: \"password\"; Source: \"00000000-00005260.00000001.178549.00BE2000.00000004.mdmp\")\n Found string \"sha1fornonsecretpurposes\" (Indicator: \"secret\"; Source: \"00000000-00005260.00000001.178549.08960000.00000004.mdmp\")\n Found string \"passwordderivebytes\" (Indicator: \"password\"; Source: \"00000000-00005260.00000001.178549.08960000.00000004.mdmp\")\n Found string \"secretagreementflags\" (Indicator: \"secret\"; Source: \"00000000-00005260.00000001.178549.089A0000.00000004.mdmp\")\n Found string \"safencryptsecrethandle\" (Indicator: \"secret\"; Source: \"00000000-00005260.00000001.178549.089A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00005260.00000000.177536.00F01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005260)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$54","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0\" (Indicator: \"Set-ItemProperty\"; File: \"AMSI\")\n Found string \"Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00000800.00000000.184391.07500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005260.00000000.177536.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"fc9cb3ee0be64271b614b46892a28d82ad235feb0bb7be0f01d895b5b9a1bff8.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005260.00000000.177536.00F11000.00000002.mdmp, 00000000-00005260.00000001.178549.6EE05000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69f0f03e4465ceacb90e55a8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"