Hackers Built a Windows Backdoor Whose Entire C2 Lives Inside Microsoft 365

SHA-256e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34HTA stager, CSIS Indo-Pacific lureSHA-256e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcfHTA stager, Bajo de Masinloc lureSHA-2564d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3fHTA stager, Taiwan information-warfare workshop lureSHA-256f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8HTA stager, Taiwan legislative-tax lureSHA-25601b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31aHTA stager, Venezuela and Ukraine news lureSHA-2565a35fcd4458e808ab0fa52bb2a92923b60566ee4d7aaadaac7c95cad3d839562HTA stager, Venezuela and Ukraine news lureSHA-25617b53ffa8e005f0e82491d3f9c0a4984c44da52e1668a855c11a137f627c5b4bHTA stager, institutional disciplinary-action lureSHA-256484ab497072ea09f12187b349f5b1c80754e4942408a009cccb20a2a3c8c6506WSF stager, institutional disciplinary-action lureSHA-2563a94910eb8022592ce030e6861359f7e980fc1b5a6ccd290cbb071d3e95ed02aHTA stager, TPiE inauguration lureSHA-2566a1dbbfcfe6867ac83d35012b2717084388b4a34707efd0b725466dfd0e8fa56WSF stager, TPiE inauguration lureSHA-25675c12795016ae48b1bddd34a9f5adea63a12f58701eae01e1b4ab3d9dfa1513cHTA stager, Tehran bilateral-summit lureSHA-256bd8ddc8f33e0fe43147ee6f1713654996420a27c5d2cd91751ad67124ebc6fe4WSF stager, Tehran bilateral-summit lureSHA-256b75492466462141c56d97b705f0c606faf272577631dc2822aa8d6bda53633b6HTA stager, cross-border repression seminar lureSHA-25623d5f1af8581ae200615d9a66d539f2043c3248b649e862557b379d7e8b7a3acWSF stager, cross-border repression seminar lureSHA-2560b4e5e017c0f0ccac79e13ca5d580a75af67a24ca0763f9ebfdaaeb1ba4fc739HTA stager, Latin carnival lureSHA-256ae1b45fb56b9f1b9cb3ee30d2bb1279c9b90b70bb62f8de305d198c6a4e0585eWSF stager, Latin carnival lureSHA-256cd3509fa82e506cc6f2eeafa0a45d4b8b76a07edadd29779daf00568febcaba7HTA stager, C-DAC lureSHA-256b8e6e83a73e6e07f8873c364dd2a4b830bceb60758163e2efcd7e387cb604655WSF stager, C-DAC lureSHA-2567969ae5f11fc163049c8eadba06f814f5edece13a707e6087c1c49011a45b838HTA stager, Latin carnival lure variantSHA-256aea5e9029f9212d05bde10f7806d1f2819be45d167e6fd877b9fb1b11088ac90WSF stager, Latin carnival lure variantSHA-2567fa98efba59614cec0b7291aedee98764f8dc037b6cc798c93951a31208e9e32HTA stager, internal-review lureSHA-25665f4b9292e91abfa5adf42a03526932930c1c0a436bb186a7948fe6770295788WSF stager, internal-review lureSHA-25661a8f5add6c35f99c389012dbb2343061fd0b54611b40490b9a7f0b49d707da0Stage 2 JScript downloader and decryptorSHA-256747b1d13bdf06956b5da5f47250fefd5284ebcf7961971732c3d348aa1a2d533Stage 2 JScript downloader and decryptorSHA-256a13182699a12a8dd9d07c336dbd8de5e9b086b9b09793b7de2e9761aa03ce1dcStage 2 JScript downloader and decryptorSHA-2562f1513c822af0c6635dd3c69dc38f0b2f6e02012ea36415fff111a5d4d5fae05Stage 2 JScript downloader and decryptorSHA-256a0e91085f08956a9a7034ace73cee60cb211f5d96f02bc91a026601bde8f2221Stage 2 downloader, HTA branchSHA-25647f98dfe01759a464e22d5ec55d012dccb38ce010dd73e3ba8d7ffefca12b4b2Stage 2 downloader, WSF branchSHA-256b3416726a064dd7f657bbb400adeb365eea7f8bb60783ad2d9da1a1d93768731Stage 2 downloader, HTA branchSHA-2560a6fb71ab1362d065c7ec2678c1e73d9a0721b0e7099d392ba7559bb2eec4970Stage 2 downloader, WSF branchSHA-256f0c1dc6d6daa4d010932c7818ed5f22929c182f58e5f495fabe2fb3cfc835b97Encrypted JScript orchestratorSHA-2565555e904101689351a2a1359c9c06da0a57139a9470df7d26823c1b75db55041Encrypted BinaryFormatter resourceSHA-2565168a2696a0ed858f996f388bfe94f952d475158f4ee6206816608936db005caEncrypted BinaryFormatter resourceSHA-2567c2ac9c040b3300bffa7d2e435dbb1bc12e7efd644d2216d603c72121266395cEncrypted JScript orchestratorSHA-256d87201c1299a7f5854929645e6891c6c424d2a690031272bedacba7c5fe73a3eEncrypted BinaryFormatter resourceSHA-256334f39279ff3aae40fe74340c887ae018c75bc42790586bdf9070adb5889100cEncrypted BinaryFormatter resourceSHA-256077bd873217d8abfbb6482d11966ca34f3fef7ad5166f24fbc5dc3ddefe894a1Encrypted JScript orchestratorSHA-256ad0bd2b45e2416fb1384bf30af068d857e7c06b4226615d66b55b610a34c5670Encrypted BinaryFormatter resourceSHA-256e2f59d8d5a81583ed482b6c7bf37699efdb2264e452cf7d8cfc0c54dfbd9ab3fEncrypted BinaryFormatter resourceSHA-2563a4c9020eeb5ef22a1ff443e606ccb6705fe287c583121c713d2c9f9f1f2a2afEncrypted JScript orchestratorSHA-2564b614e5c37abaddca162119e42a969945caa681305e246e0ed0060ea9984008bEncrypted JScript orchestratorSHA-256c8e1239d7276178b6620f47ec4880494be1cb394477b223fc54bffb0947bff50Encrypted BinaryFormatter resourceSHA-256079acd58a74479ac8b108b618d2a4da8a8bd560a04459cd90e2fec9da5027513Encrypted BinaryFormatter resourceSHA-2568e1d68906d6de92f359945d3a95da1480e72773a3e8dea7682d6bf0f6699f75fEncrypted JScript orchestratorSHA-256170b0eee60a335f32c1d0c19a0bb8d8bbc0a5b298ea9486b546f58d25cc8a464Encrypted BinaryFormatter resourceSHA-256b31ca75f73a9363b0e35042a41216c3f581eaa0b9cd78cb58f089c2e40babd40Encrypted BinaryFormatter resourceSHA-256d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bfTestAssembly.dll downloaderSHA-256133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098TestAssembly.dll downloaderSHA-2569fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542fTestAssembly.dll downloaderSHA-256d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548aTestAssembly.dll downloaderSHA-256131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46TestAssembly.dll downloaderSHA-25609ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cffAntino Gen 2 slc.dll backdoorSHA-2560c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bdAntino Gen 2 standalone fake installerSHA-2561fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567daAntino Gen 1 slc.dll backdoorSHA-25640e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91dConfigured Antino Gen 1 standalone backdoorSHA-2565c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cbConfigured Antino standalone backdoorSHA-256971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059dAntino Gen 2 standalone fake installerSHA-2569b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3Antino Gen 2 standalone fake installerSHA-256b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85eAntino Gen 2 standalone fake installerSHA-256ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800Unpacked Antino standalone backdoor memory imageSHA-256e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530Antino Gen 2 slc.dll backdoorSHA-256e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bbAntino Gen 2 slc.dll backdoorSHA-256fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1Antino Gen 2 slc.dll backdoorIP address103[.]27[.]110[.]220Historical serving IP for the payload hosted on wps-cn[.]comDomainosc-cdn[.]comSpear-phishing sender domainDomainoisadjfoinsiduhfnoisdnfosdnoifnsoid[.]pages[.]devExecution-tracking domainDomaind2nq35tel3ucuo[.]cloudfront[.]netCloudFront staging domainDomainpub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]devCloudflare R2 staging domainDomainpub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]devCloudflare R2 staging domainDomainmy-3lyt6wcp[.]pages[.]devCloudflare Pages delivery domainDomainmy-qc39r814[.]pages[.]devCloudflare Pages delivery domainDomainmy-662ylt3w[.]pages[.]devCloudflare Pages delivery domainDomainmy-6g16qsfe[.]pages[.]devCloudflare Pages delivery domainDomainmy-goq6xmbm[.]pages[.]devCloudflare Pages delivery domainDomainmy-h3qli6kq[.]pages[.]devCloudflare Pages delivery domainDomainmy-sv7c1fzs[.]pages[.]devCloudflare Pages delivery domainDomainmy-u0up9qri[.]pages[.]devCloudflare Pages delivery domainDomainmy-vtsdod2n[.]pages[.]devCloudflare Pages delivery domainDomainmy-wgoxp32b[.]pages[.]devCloudflare Pages delivery domainDomainmicrosoft-flash[.]comStandalone fake-installer delivery domainDomainwps-cn[.]comStandalone fake-installer delivery domainURLhxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en.exeStandalone Antino fake-installer deliveryURLhxxps://www[.]wps-cn[.]com/downloads/flashcenter_pp_ax_install_en.exeStandalone Antino fake-installer deliveryURLhxxps://my-662ylt3w[.]pages[.]dev/Institutional_Disciplinary_Action_Report_May_2026.htaHTA deliveryURLhxxps://my-662ylt3w[.]pages[.]dev/Institutional_Disciplinary_Action_Report_May_2026.wsfWSF deliveryURLhxxps://my-6g16qsfe[.]pages[.]dev/the%20May%2027%20inauguration%20of%20the%20TPiE.htaHTA deliveryURLhxxps://my-6g16qsfe[.]pages[.]dev/the%20May%2027%20inauguration%20of%20the%20TPiE.wsfWSF deliveryURLhxxps://my-goq6xmbm[.]pages[.]dev/Tehran_Bilateral_Summit_Proceedings_May2026.htaHTA deliveryURLhxxps://my-goq6xmbm[.]pages[.]dev/Tehran_Bilateral_Summit_Proceedings_May2026.wsfWSF deliveryURLhxxps://my-h3qli6kq[.]pages[.]dev/CrossBorder_Repression_Seminar_Agenda.htaHTA deliveryURLhxxps://my-h3qli6kq[.]pages[.]dev/CrossBorder_Repression_Seminar_Agenda.wsfWSF deliveryURLhxxps://my-sv7c1fzs[.]pages[.]dev/Extravaganza%20Latin%20Carnival.htaHTA deliveryURLhxxps://my-sv7c1fzs[.]pages[.]dev/Extravaganza%20Latin%20Carnival.wsfWSF deliveryURLhxxps://my-u0up9qri[.]pages[.]dev/UO%20-C-DAC%20%281%29.htaHTA deliveryURLhxxps://my-u0up9qri[.]pages[.]dev/UO%20-C-DAC%20%281%29.wsfWSF deliveryURLhxxps://my-vtsdod2n[.]pages[.]dev/Extravaganza%20Latin%20Carnival%20post%20copy.htaHTA deliveryURLhxxps://my-vtsdod2n[.]pages[.]dev/Extravaganza%20Latin%20Carnival%20post%20copy.wsfWSF deliveryURLhxxps://my-wgoxp32b[.]pages[.]dev/Internal_Review_Dossier_0520.htaHTA deliveryURLhxxps://my-wgoxp32b[.]pages[.]dev/Internal_Review_Dossier_0520.wsfWSF deliveryURLhxxp://d2nq35tel3ucuo[.]cloudfront[.]net/4oyE4n4ozLQ0.logStage 2 deliveryURLhxxp://d2nq35tel3ucuo[.]cloudfront[.]net/LtVGUSsyUTDA.logStage 2 deliveryURLhxxp://d2nq35tel3ucuo[.]cloudfront[.]net/TzzyYlYnJ40Z.logStage 2 deliveryURLhxxp://d2nq35tel3ucuo[.]cloudfront[.]net/tdyvHHVcrci8.logStage 2 deliveryURLhxxp://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/Qw7Womin4X6NStage 2 deliveryURLhxxp://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/kVFPxm1uAjOYStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/5SVIdjpRQjkZStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/PbyfSk69AwVfStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/qMD71Z95clTfStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/HenUWB51MwpGStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/q9LgxIaU1CJKStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/BKvYRxPiGpbMStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/nswz3cb9lhuCStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/6HJV5qV5BTLsStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/MKJacn3hFt3YStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/cX8MChhuVvzzStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/byrdvvZEZZlkStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/5TGrbjCCLa8MStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/s0p18dgHR4PZStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/zlKDeyO3HuUSStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/icWMOGLJcfQOStage 2 deliveryURLhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/5U7kzhvlYlVFStage 2 deliveryURLhxxps://d2nq35tel3ucuo[.]cloudfront[.]net/9q9OlLKCm0an2ct1.jsEncrypted JScript orchestratorURLhxxps://d2nq35tel3ucuo[.]cloudfront[.]net/LwqPW64Xl0ti3q7s.txtEncrypted BinaryFormatter resourceURLhxxps://d2nq35tel3ucuo[.]cloudfront[.]net/HsOw0YU9s11dxyr1.txtEncrypted BinaryFormatter resourceURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/0u25lAqY58or53ra.jsEncrypted JScript orchestratorURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/gpv0IRMtvto6e8t2.txtEncrypted BinaryFormatter resourceURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HzjNPgRE9ir92e38.txtEncrypted BinaryFormatter resourceURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/2laZiB2zvnx04jze.jsEncrypted JScript orchestratorURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/wyLwwCu43j1wf2pg.jsEncrypted JScript orchestratorURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/ThyI9pwewrh_a1pr.txtEncrypted BinaryFormatter resourceURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/8ypvQLxJvggmrz94.txtEncrypted BinaryFormatter resourceURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/vD68BdmB2ky28gcc.jsEncrypted JScript orchestratorURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/oaFE7PJHk0h_emqt.txtEncrypted BinaryFormatter resourceURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/AcPP9fCvdjztmho8.txtEncrypted BinaryFormatter resourceURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/7ChyKauxbnuftp68.jsEncrypted JScript orchestratorURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/KOOOT4a76st012bx.txtEncrypted BinaryFormatter resourceURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/Ub4RJzNIrfleri8t.txtEncrypted BinaryFormatter resourceURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HeiqAW6ZGatherOsState.exe.luySideload-package componentURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HeiqAW6Zslc.dll.pzsAntino backdoor deliveryURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HeiqAW6ZOsGather.dat.sykSideload-package componentURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgGatherOsState.exe.lzjSideload-package componentURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgslc.dll.iwqAntino backdoor deliveryURLhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgOsGather.dat.aelSideload-package componentURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/bzP3NcRPGatherOsState.exe.thlSideload-package componentURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/bzP3NcRPslc.dll.czhAntino backdoor deliveryURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/bzP3NcRPOsState.dat.mxbSideload-package componentURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/VD7F3WxnGatherOsState.exe.mtmSideload-package componentURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/VD7F3Wxnslc.dll.fscAntino backdoor deliveryURLhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/VD7F3WxnOsState.dat.pgySideload-package componentDomaind32tpl7xt7175h[.]cloudfront[.]netDownloader infrastructure overlap with UNC6384; relationship assessed with low confidenceContextual domainrsproxy.cnLegitimate Rust mirror referenced in development artifacts; not inherently maliciousService domaingraph.microsoft.comLegitimate Microsoft Graph endpoint abused for C2; not independently evidence of compromiseService domainlogin.microsoftonline.comLegitimate authentication endpoint; not independently evidence of compromiseURL pattern//my-<project>.pages.dev/File_download?m=<target-identifier>Phishing download pattern; placeholders are unresolvedDomain patternmy-<project>.page[.]devDelivery pattern reproduced as published, including singular “page”Domain patternpub-<32-character hexadecimal identifier>[.]r2[.]devCloudflare R2 staging patternFile nameTestAssembly.dllIn-memory .NET downloader and launcherFile nameGatherOsState.exeLegitimate Microsoft-signed executable abused for sideloadingFile nameslc.dllAntino backdoor libraryFile nameOsGather.datCalculator decoy executableFile nameOsState.datName appearing in later sideload-package URLsFile nameflashcenter_pp_ax_install_en.exeFake installer carrying standalone AntinoFile nameresult.ps1Attacker-controlled PowerShell scriptContextual file namemshta.exeLegitimate Windows component abused to execute HTA stagesContextual file namesdiageng.dllLegitimate diagnostics engine abused by AntinoContextual file namesdiagnhost.exeLegitimate diagnostics host abused for executionContextual file namecmd.exeLegitimate command interpreter used by AntinoContextual file namepowershell.exeLegitimate scripting executable used by AntinoFile nameItems likely to be considered in the next Cabinet meeting.T11065885611.doc.exeIndian government-themed executable lureCloud path/antino/heartbeats/{id}.jsonOneDrive status uploadsCloud path/antino/heartbeats/<session_id>.jsonGeneration 2 heartbeat path as publishedCloud path/antino_downloads/{file}Stolen victim data staged for operator retrievalCloud path/antino_uploads/{file}Incoming operator toolkit stagingFile pattern{session_id}.jsonSession-based heartbeat filenameMessage subjectcommand_req_[session_id]Outlook command request prefixMessage subjectcommand_res_[session_id]Outlook response prefixAssembly GUIDb2b3adb0-1669-4b94-86cb-6dd682ddbea3Shared downloader metadata detection markerCOM CLSID{1F3D8AA5-9EBF-4EE4-85C2-EA40379AEDE8}Legitimate diagnostic class abused by AntinoContextual file pathC:\Windows\diagnostics\system\PCWLegitimate troubleshooting package abused by AntinoFile path patternC:\Windows\Temp\SDIAG_<GUID>Temporary diagnostics working directoryFile path%LOCALAPPDATA%\Windows GatherOSStateKit\Persistent Antino installation directoryProcess command%windir%\SysWOW64\sdiagnhost.exe -EmbeddingObserved diagnostics execution commandManifest identityAntinoAppApplication identity in newer Antino buildsPE section.cfgObfuscated JSON configuration sectionBuild pathD:\a\antino\antino\client\src\core.rsAntino development artifactBuild pathD:\a\antino\antino\client\src\signaller\mod.rsAntino development artifactBuild pathD:\a\antino\antino\client\src\artillery\run.rsAntino development artifactBuild pathD:\a\antino\antino\client\src\config\mod.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command_client.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\registry.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\add_to_run.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\cmd.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\download_file.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\execute_program.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\exit.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\list_files.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\load.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\ps.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\system_info.rsAntino development artifactBuild pathD:\a\antino\antino\shared\src\command\upload_file.rsAntino development artifactBuild pathD:\a\antino\antino\target\x86_64-pc-windows msvc\release\deps\slc_template.pdbDebug path reproduced from the published reportBuild pathD:\a\antino\antino\target\x86_64-pc-windows-msvc\release\deps\antino_client_template.pdbAntino debug artifactBuild pathD:\a\antino\antino\target\i686-pc-windows-msvc\release\deps\antino_client_template.pdbAntino debug artifact