26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 184d0b251392… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 184d0b251392…. Malware family: Trojan.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 16 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":28},"behavioralIndicators":{"malicious":16,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f6,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin")28:T40b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin")29:Ta71,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg" (Indicator: "CertOpenStore"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizefile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal errorasynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizefile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal errorasynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.Floatafter array elementEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk S" (Indicator: "CryptReleaseContext"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span" (Indicator: "CertOpenSystemStoreW"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span" (Indicator: "CryptAcquireContextW"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "non-Go function at pc=unexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResult%SystemRoot%\system32\exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too largeunexpected map key typeE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in registryindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection sc" (Indicator: "CertGetCertificateChain"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin"), Found api reference "anmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallreflect.Value.Interfacereflect.Value.NumMethod23283064365386962890625", missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryW" (Indicator: "CertFreeCertificateChain"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexunexpected key value typeExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleencountered a cycle via %sSouth Africa Standard T" (Indicator: "CertFreeCertificateContext"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin"), Found api reference "imeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125RtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pairE" (Indicator: "CertEnumCertificatesInStore"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#$" (Indicator: "CertCreateCertificateContext"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin"), Found api reference ": resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin"), Found api reference ": resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxch" (Indicator: "CertOpenStore"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.Floatafter array elementEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk" (Indicator: "CryptReleaseContext"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spa" (Indicator: "CertOpenSystemStoreW"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spa" (Indicator: "CryptAcquireContextW"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "non-Go function at pc=unexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResult%SystemRoot%\system32\exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too largeunexpected map key typeE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in registryindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection s" (Indicator: "CertGetCertificateChain"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin"), Found api reference "anmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallreflect.Value.Interfacereflect.Value.NumMethod23283064365386962890625", missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectory" (Indicator: "CertFreeCertificateChain"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexunexpected key value typeExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleencountered a cycle via %sSouth Africa Standard" (Indicator: "CertFreeCertificateContext"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin"), Found api reference "imeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125RtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pair" (Indicator: "CertEnumCertificatesInStore"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#" (Indicator: "CertCreateCertificateContext"; File: "184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin")2b:T680," HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat 04 Jul 2026 19:02:33 GMT Content-Length: 36932 Connection: keep-alive Set-Cookie: sessionid=ecc2c05477ad3b98bab3ceea; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; path=/; secure; HttpOnly; SameSite=None with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /api/config HTTP/1.1 Connection: Keep-Alive User-Agent: SystemInfo Client/1.0 Host: terracello.icu" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat 04 Jul 2026 19:02:34 GMT Content-Type: text/plain Content-Length: 10580 Connection: keep-alive with response body ==>4630594341314246556859495252345245307354516B64525531784F5867495652465166466C356543774D66435659544355424152416C4956414E59516C4262....... "GET /time/1/current?cup2key=9:gACQLOegbhHRp3r2b7MpWwKtkOlYhc1be8XWT6HqBrs&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 3046022100dcd1b62c87a6ff9e351afae98965699e16e79aab301e03a7989f2a1285c2bcf2022100d346d60b08c1ce9b7c80794ad155826ce76a6e413b5034edbb8ff7555e732419:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"3046022100dcd1b62c87a6ff9e351afae98965699e16e79aab301e03a7989f2a1285c2bcf2022100d346d60b08c1ce9b7c80794ad155826ce76a6e413b5034edbb8ff7555e732419:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Sat 04 Jul 2026 19:02:40 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-site Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313738333139313736303534312C227365727665725F6E6F6E6365223A342E3037313036....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Sat 04 Jul 2026 18:12:07 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 3033 with no response body "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMS0wMzAwMTIuNDk5MDAwEgkIABADGJABIAAaEAoIMTc2OTk0MzYSBAgCEAE=#FG5ZMGD4i5w= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Sat 04 Jul 2026 19:02:40 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEYCIQCJO4Dt/OypuSxfAF8W+7Tb4Fe+HOqK7ubI+gV7VF+jCAIhAKi/eZLQEzgtmaTaIEp5rRzs/UrIMwG9VZvI7zFRq4p/ X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin X-Geo-Level-1: us-il Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /og/_/ss/k=og.qtm.dx8igAtVUKc.L.W.O/m=qmd,qcwid,d_b_gm3,d_wi_gm3,d_lo_gm3/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuRXSIc6ZAkT0f0eC2Gvh5vLRXhMw HTTP/2 Host: www.gstatic.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Browser-Year: 2026 Sec-Fetch-Storage-Access: active Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 X-Browser-Validation: mbKdpV8Df6MeX3t+QoahfSgokv4= Priority: u=0 Accept: text/css,*/*;q=0.1 X-Browser-Channel: stable Sec-Ch-Ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 X-Client-Data: CN7cygE= Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd X-Browser-Copyright: Copyright 2026 Google LLC. All Rights reserved. Sec-Fetch-Dest: style" Response ==> HTTP/2 200 OK Content-Type: text/css; charset=UTF-8 Date: Sat 04 Jul 2026 17:53:32 GMT Server: sffe Expires: Sun 04 Jul 2027 17:53:32 GMT Vary: Accept-Encoding Origin Content-Encoding: gzip Cross-Origin-Opener-Policy: same-origin; report-to="one-google-eng" Last-Modified: Sat 13 Jun 2026 01:30:22 GMT X-Content-Type-Options: nosniff X-Xss-Protection: 0 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/one-google-eng Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"one-google-eng" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/one-google-eng"}]} Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 4150 with no response body37:T1a61," "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A436F6F6B69653A204E49443D3532383D516858556461547A6A46724D58453032514C5674316B3257694132796E415F4F7569746E357A567269356368672D756B6F54675948517150775A6C58566B6442764E4D4232365F653567572D57364F566F5335355A526A74563043796A5934434969567A764658326A6C475A5135307533483477515A6E764C52494E526C714A7A475773356D784E415739596E6750644B4D2D65346F714935585A5A6D4371483746697970506134614B666B49617A67394135684C5166784C66306B777457783774576C5353697469674E53544E353062526E4C31555170664D6B6373764B61466A730A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Sat 04 Jul 2026 19:02:41 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin P3p: CP="This is not a P3P policy! See g.co/p3phelp for more info." Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Set-Cookie: NID=532=vmg1LQpNvD9-ZIgokGviO3QxXCM3KMRaJGlXa65ANFsSn4a8LFC3otr_TEKDQiYRX-F_q71_wdU4ZACCh-wwldBPAKgebftMdIx-zy7qVFEW6Y0dLnQQig-yTiNMUOwlO2itb7mY-TJlBSBzshS-_Y5czVqn4oedIhyfBUkEKJs3IqtegHd_pMR8TfSGL0q47676epgCFJaa_kT7tVMeD03cjgGJSYJClBAYWl8; expires=Sun 03-Jan-2027 19:02:41 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtHikmLw15BiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZAbBoSyOYMxBPCw9imALEQN8fFjUsvsQn8WHXRW0k3Kb8wPjMlNa8ks6QyJ7O4JDE5Ob80r6S4OLWoLLUo3sjAyMzAzMhQz8AivsAAAHMlJAU" Access-Control-Allow-Credentials: true Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/IdentityListAccountsHttp/cspreport/fine-allowlist X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body4c:T425,"status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValueptrEncoder.encode should have emptied ptrSeen via defersstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size values\" in Source: 184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a4958a6dddf9512420bd2e7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a4958a6dddf9512420bd2e7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin\" has section name .rdata with entropy \"7.277642794248574\"\n \"184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1.bin\" has section name .rsrc with entropy \"7.137297188716735\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a4958a6dddf9512420bd2e7"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"