26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 0dcbe5afb178… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0dcbe5afb178…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 2/27 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T634,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp")28:T5b8,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp")29:Ta18,Found reference to "forHKDF" (Indicator: "HKDF"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") file/memory contains long string with (Indicator: "HMAC"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to "runtime.useAeshash" (Indicator: "Aes"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to "crypto/internal/fips140deps/cpu.ARM64HasSHA512" (Indicator: "SHA512"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to "crypto/internal/fips140deps/cpu.S390XHasSHA512" (Indicator: "SHA512"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to "runtime.useAeshash" (Indicator: "Aes"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to "crypto/internal/fips140deps/cpu.ARM64HasSHA512" (Indicator: "SHA512"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to "crypto/internal/fips140deps/cpu.S390XHasSHA512" (Indicator: "SHA512"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp")2a:T4a0,Found reference to API "crypto/internal/fips140/aes.decryptBlock" (Indicator: ".decrypt"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "crypto/internal/fips140/aes.decryptBlockGeneric" (Indicator: ".decrypt"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "crypto/internal/fips140/aes.decryptBlockAsm" (Indicator: ".decrypt"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "crypto/internal/fips140/aes.decryptBlockAsm.abi0" (Indicator: ".decrypt"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found reference to API "crypto/internal/fips140/aes.decryptBlock" (Indicator: ".decrypt"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to API "crypto/internal/fips140/aes.decryptBlockGeneric" (Indicator: ".decrypt"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp") Found reference to API "crypto/internal/fips140/aes.decryptBlockAsm.abi0" (Indicator: ".decrypt"; Source: "00000000-00001672.00000000.260989.3F610000.00000002.mdmp")2b:T64cf,Found api reference ".level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscastGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busy" (Indicator: "CertOpenStore"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "too many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "too many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "lex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array element14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "(JSON):invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling 37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZeroGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentle" (Indicator: "CertOpenSystemStoreW"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "(JSON):invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling 37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZeroGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentle" (Indicator: "CryptAcquireContextW"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "pected method stepRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after ReadT+02:00.000 sea-passagedevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key type23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locks" (Indicator: "CertGetCertificateChain"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: invalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockinvalid pattern syntax: T+00:30.000 pilot-stationT+01:00.000 cha" (Indicator: "CertFreeCertificateChain"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failureGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: T+04:00.000 full-sea-speedT+53:00.000 coast-approach P%-3d %-8d %-7d %-8d %sinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHa" (Indicator: "CertFreeCertificateContext"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin"), Found api reference "ndleencountered a cycle via %sinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033203125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kindRtlNtStatusToDosErrorNoTebT+00:00.000 departure-berthchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pair363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses size" (Indicator: "CertEnumCertificatesInStore"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type abi.NewName: tag too long: httpservecontentkeepheaders %-4s %-22s %-10s %-10s %sfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#" (Indicator: "CertCreateCertificateContext"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin"), Found api reference "an't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')284217094304" (Indicator: "CertAddCertificateContextToStore"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin"), Found api reference "an't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')284217094304" (Indicator: "CertVerifyCertificateChainPolicy"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin"), Found api reference ".level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscastGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file bus" (Indicator: "CertOpenStore"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "(JSON):invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling 37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZeroGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentl" (Indicator: "CertOpenSystemStoreW"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "(JSON):invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling 37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZeroGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentl" (Indicator: "CryptAcquireContextW"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "pected method stepRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after ReadT+02:00.000 sea-passagedevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key type23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding lock" (Indicator: "CertGetCertificateChain"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: invalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockinvalid pattern syntax: T+00:30.000 pilot-stationT+01:00.000 ch" (Indicator: "CertFreeCertificateChain"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failureGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: T+04:00.000 full-sea-speedT+53:00.000 coast-approach P%-3d %-8d %-7d %-8d %sinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByH" (Indicator: "CertFreeCertificateContext"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin"), Found api reference "ndleencountered a cycle via %sinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033203125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kindRtlNtStatusToDosErrorNoTebT+00:00.000 departure-berthchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pair363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses siz" (Indicator: "CertEnumCertificatesInStore"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type abi.NewName: tag too long: httpservecontentkeepheaders %-4s %-22s %-10s %-10s %sfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!" (Indicator: "CertCreateCertificateContext"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin"), Found api reference "an't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')28421709430" (Indicator: "CertAddCertificateContextToStore"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin"), Found api reference "an't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')28421709430" (Indicator: "CertVerifyCertificateChainPolicy"; File: "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin")2c:T1609,Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin Observed string: "Goal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=active < 0unknown pcruntime: ggoroutine (durable)complex128t.Kind == IsValidSidLogonUserWLockFileExReOpenFileNetUserAddNetUserDelNtOpenFileWSASocketWexecerrdothttp2debugrsa1024mincrypto/rsacrypto/tlsx509rsacrtCounterKDF" (Indicator: "Goal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=active < 0unknown pcruntime: ggoroutine (durable)complex128t.Kind == IsValidSidLogonUserWLockFileExReOpenFileNetUserAddNetUserDelNtOpenFileWSASocketWexecerrdothttp2debugrsa1024mincrypto/rsacrypto/tlsx509rsacrtCounterKDF") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "reflect: reflect.Value.UnsafePointer on an invalid notinheap pointercrypto/hmac: hash generation function does not produce unique valuesruntime.Pinner: found leaking pinned pointer; forgot to call Unpin()?" (Indicator: "reflect: reflect.Value.UnsafePointer on an invalid notinheap pointercrypto/hmac: hash generation function does not produce unique valuesruntime.Pinner: found leaking pinned pointer; forgot to call Unpin()?") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/rand.fatal" (Indicator: "crypto/rand.fatal") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin, Observed string: "crypto/rand.init.0" (Indicator: "crypto/rand.init.0") in Source: 0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin2d:T1a3a,Found XOR loop in file "sample.bin" at offset 95058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1422984; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1425384; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1512940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1594118; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1663632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2765099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2902860; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 67209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1474663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1614255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1629533; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1636189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1645437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1685103; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1706845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1708271; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1727101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1729789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1752687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1765231; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1774511; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1782127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1801519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1813423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1823869; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1856477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1875503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1876079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1884029; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1884399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1922141; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1941487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1945519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1979389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2017373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2058333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2077551; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2083887; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2125949; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2136239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2150255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2152285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2155261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2180079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2205487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2250717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2279343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2303869; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2327663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2348783; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2350191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2363613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2831189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 191670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 305551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 305587; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 305807; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418757; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 430473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1095000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1104972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1314728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1346808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1346920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1347064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1354972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1460143; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1582182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1825721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2370772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2394121; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2396190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2435392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2604468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2904408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2934596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3027312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3158417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3207708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3236981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3264138; code bytes = 80302e:T450,Found system information discovery API: "GetSystemInfo" in file "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in file "0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in "00000000-00001672.00000000.260989.3F610000.00000002.mdmp"2f:T4f8," HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Sat 20 Jun 2026 14:50:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4420 Connection: keep-alive Set-Cookie: stel_ssid=a533245aa44b1f2459_2923787013681656217; expires=Sun 21 Jun 2026 14:50:38 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......47:T432,Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----44afff7a573ec906d378Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com------44afff7a573ec906d378Content-Disposition: form-data; name="hwid"E6A396902B89A8CB9A45-07de0940-fa46-1F24190------44afff7a573ec906d378Content-Disposition: form-data; name="build_id"88c86f88171a3c1f928fcc3630b2e8a8------44afff7a573ec906d378Content-Disposition: form-data; name="format"json------44afff7a573ec906d378--"; File: "PCAP") Found string "------44afff7a573ec906d378Content-Disposition: form-data; name="hwid"E6A396902B89A8CB9A45-07de0940-fa46-1F24190------44afff7a573ec906d378Content-Disposition: form-data; name="build_id"88c86f88171a3c1f928fcc3630b2e8a8------44afff7a573ec906d378"; Source: "00000000-00008112-00000CCB-3093759104")48:Ta14," "------44afff7a573ec906d378Content-Disposition: form-data; name="hwid"E6A396902B89A8CB9A45-07de0940-fa46-1F24190------44afff7a573ec906d378Content-Disposition: form-data; name="build_id"88c86f88171a3c1f928fcc3630b2e8a8------44afff7a573ec906d378Content-Disposition: form-data; name="format"json------44afff7a573ec906d378--" HTTP/1.1 200 OK Date: Sat 20 Jun 2026 14:50:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=P4KEj1j1%2BWw9mS4SH%2FrLGQRbMhFLR7vEidDV5Z7nQM4ZUM2oagVLtWzqbTFAgyU1nU6Uo5ViuLYz1y8Y4URFcqvfCHSU1ZRoJ06cOOh6AfaX%2Fc1BC%2BRBbSxRfI%2BbYyb8eoA%3D"}]} Content-Encoding: gzip CF-RAY: a0eb9645ac2debe2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......4a:Tb56," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"},{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"},{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"},{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"},{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"},{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n CreateThread\n GetProcAddress\n GetThreadContext\n LoadLibraryExW\n WriteFile\n VirtualAlloc\n LoadLibraryW\n GetSystemDirectoryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"},{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"},{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"},{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$42","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$43","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00008112-00000C2B-3089184288\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00008112-00000C2B-3089184391\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00008112-00000C2B-3089184465\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00008112-00000C2B-3089184504\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00008112-00000C2B-3089184542\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00008112-00000C2B-3089184581\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008112-00000C2B-3088981928\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008112-00000C2B-3088981928\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" \"------44afff7a573ec906d378Content-Disposition: form-data; name=\"hwid\"E6A396902B89A8CB9A45-07de0940-fa46-1F24190------44afff7a573ec906d378Content-Disposition: form-data; name=\"build_id\"88c86f88171a3c1f928fcc3630b2e8a8------44afff7a573ec906d378Content-Disposition: form-data; name=\"format\"json------44afff7a573ec906d378--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":56,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":35,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":35,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"],"sample_flags":["Extracted Files","Network Traffic"],"sandbox_reports":[{"id":"6a36a8a0bc8344b020085669","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W64.Obfuscated.h","submit_name":"0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin","analysis_start_time":"2026-06-20T14:50:09+00:00","indicators_count":{"informative":120,"suspicious":8,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"6a36a890713d883ebf0d6777","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W64.Obfuscated.h","contacted_countries":["GBR"],"submit_name":"0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin","analysis_start_time":"2026-06-20T14:49:54+00:00","indicators_count":{"informative":151,"suspicious":25,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"6a3690827583b74588002134","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":81,"malware_family":"W64.Obfuscated.h","contacted_countries":["GBR"],"submit_name":"0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin","analysis_start_time":"2026-06-20T13:07:16+00:00","indicators_count":{"informative":150,"suspicious":25,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"address":"104.21.13.185","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]}],"dns_resolutions":[{"domain":"cht.utvrent.com","address":"104.21.13.185","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":158,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/t0mdr","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /t0mdr HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nHost: telegram.me","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"host":"cht.utvrent.com","host_ip":"104.21.13.185:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----44afff7a573ec906d378\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nContent-Length: 345\nHost: cht.utvrent.com","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}],"processes":[{"pid":1672,"ppid":0,"name":"0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin.exe","command_line":"","sha256":"0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20","normalized_path":"C:\\0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20.bin.exe","uid":"00000000-00001672","icon":"$4d"}],"all_imported_dlls":["ws2_32.dll","ntdll.dll","advapi32.dll","sechost.dll","gdi32.dll","lpk.dll","winmm.dll","rpcrt4.dll","usp10.dll","ole32.dll","oleaut32.dll","msctf.dll","KernelBase.dll","msvcrt.dll","user32.dll","shlwapi.dll","api-ms-win-core-synch-l1-2-0.dll","nsi.dll","kernel32.dll","bcryptprimitives.dll","bcrypt.dll","fltLib.dll","imm32.dll","VxSSL64.dll","win32u.dll","OnDemandConnRouteHelper.dll","webio.dll","rsaenh.dll","dnsapi.dll","ncrypt.dll","ncryptsslp.dll","apphelp.dll","ucrtbase.dll","msvcp_win.dll","FWPUCLNT.DLL","dpapi.dll","gdi32full.dll","powrprof.dll","winhttp.dll","mswsock.dll","winnsi.dll","ntasn1.dll","cryptsp.dll","umpdc.dll","sspicli.dll","crypt32.dll","combase.dll","schannel.dll","msasn1.dll","gpapi.dll","IPHLPAPI.DLL","rasadhlp.dll","cryptbase.dll","mskeyprotect.dll","cfgmgr32.dll","winmmbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ICPKK326.htm","sha256":"279cc119c0e96ee498e4d6001bf9ff14425becd9303b9e26ea64a8cd500f4763","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"~DF38B1D322982CBF2E.TMP","sha256":"3a62ca4577d0c8258d260f11fdb158efbebf2517070031f6a9decadf7ad92e05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"~DFB424E1B4C026CA08.TMP","sha256":"c141f4c81ff4254367bf022b9bb2eb5a71575e318f077120dfca0d57732ecca5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"~DFEA66388E16A02D50.TMP","sha256":"1250c11a57e9644bab06635d6c621e81efb3ad9c98588fbc0bf1d428406e81f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"nav_logo229_1_.png","sha256":"ca858453ce21cabdf9911c6fa3291aa630df344244bc183a4d5ae9972e59f675","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"imagestore.dat","sha256":"58aa5bb2f70d31e78d5163ba87c1f369be47005a4151e1bebe47af12acf4f60c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"RecoveryStore._6233F5DE-6CB7-11F1-BEE7-00505691B973_.dat","sha256":"9aa1f9638ec3ba5273640ac338a0696a842a9e4d189b4a7b82551717d2206e2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"_6233F5E0-6CB7-11F1-BEE7-00505691B973_.dat","sha256":"8812af6b6d7c855720cb862502b87232b0d248f141b827a116b4b6580c05ed1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"googlelogo_white_background_color_272x92dp_1_.png","sha256":"44fc041cb8145b4ef97007f85bdb9abdb9a50d744e258b0c4bb01f1d196bf105","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"favicon_1_.ico","sha256":"6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"_6233F5E1-6CB7-11F1-BEE7-00505691B973_.dat","sha256":"a4e9c46996cbaad8814febcdb1ae9c2a45c96036d53c6c8b6cf1656966fcfac4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sha256":"5b5286982b5249c6476f2bc889ff03c4581494a50ad5a8ac5b69e4ddd2e7a891","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"05DDC6AA91765AACACDB0A5F96DF8199","sha256":"a6f8f5d4ffd1e825ffce9a55861f16aa4dbe67871b1696b976194dd8be1fdf29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"6P5LUM7X.txt","sha256":"56731f8567eb9e46710a8c9eadb56020567f1776ce1d9722e72300a916d1fee0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"Q844YVCE.txt","sha256":"13e994893a2477facd878a9a788a4f1efe471105082b1f231ff2a95e868a6ed1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"6DA548C7E5915679F87E910D6581DEF1_3B575FC3633203A7B6F1D54AF15F5DFF","sha256":"1eea4377163c50866346033d51dc216a22819a8c4077348896e8a12250f08715","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"4FA45AE1010E09657982D8D28B3BD38E_BF3890251EE43B9B7C585D8A702A23E9","sha256":"3388f55a3ecd79c13fb37b00fc6117e851f86693ecc17ffc4c6189273a2d9aaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"B3513D73A177A2707D910183759B389B_DD5C881D3BBD16C042910D28DAB6EC75","sha256":"d498d8742b6b05e91801a1922ba263b450626a14da8a7a5f0876085091241267","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"name":"B3513D73A177A2707D910183759B389B_37334A92C08D0036E183ABCF13343D9F","sha256":"99ab53dd9a7d26985c30cb3477a4137e2aa8371ad49fac77cfed334ead5484d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a36a8a0bc8344b020085669"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"},{"report_type":"sandbox","report_id":"6a3690827583b74588002134"}]},{"name":"Local\\SM0:8112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a36a890713d883ebf0d6777"}]}]}},"report_ids":{"sandbox_job_ids":["6a36a8a0bc8344b020085669","6a36a890713d883ebf0d6777","6a3690827583b74588002134"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample 0dcbe5afb178… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0dcbe5afb178…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 2/27 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample 0dcbe5afb178… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0dcbe5afb178…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 2/27 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0dcbe5afb17831300599e9cdc3c8a655c1380c86a1562db04fec664677a50e20"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample 0dcbe5afb178… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0dcbe5afb178…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 2/27 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]