26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 1d0bf84e6e27… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample 1d0bf84e6e27…. Malware family: Win/malicious_confidence_70%. Threat score 88/100. 5/27 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b"],"about":{"@type":"SoftwareApplication","name":"1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T892,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "VirtualAllocEx"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "WriteProcessMemory"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") file/memory contains long string with (Indicator: "VirtualAllocEx"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") file/memory contains long string with (Indicator: "WriteProcessMemory"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp")28:T525,Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "ResumeThread"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "SetThreadContext"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "GetThreadContext"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "SetThreadContext"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") file/memory contains long string with (Indicator: "GetThreadContext"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp")29:T78a,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp")2a:T541,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp")2b:T7d43,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerscomputationalFUEL_ESTIMATESYSTEM_STATUSGRAVITY_FORCEcommunicationlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method span.base()=bad flushGen , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=VirtualAllocExCHARLIE_SIERRABACKUP_RELAY_3ORBIT_ALTIT" (Indicator: "CertOpenStore"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "UDEPAYLOAD_STATUSREMAINING_FUELSATELLITE_SYNCORBITAL_PERIODbattery_backupSYSTEM_OPTIMALSYSTEM_NOMINALSYSTEM_MINIMALSYSTEM_FAILUREfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "UDEPAYLOAD_STATUSREMAINING_FUELSATELLITE_SYNCORBITAL_PERIODbattery_backupSYSTEM_OPTIMALSYSTEM_NOMINALSYSTEM_MINIMALSYSTEM_FAILUREfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "acreateruntime.semawakeupcommunication_arraybad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionOPTIMIZED_TRAJECTORYLAUNCH_COMMAND_ALPHAinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goWow64GetThreadContextWow64SetThreadContextGUIDANCE_VERIFICATIONlink has been severedp" (Indicator: "CertOpenSystemStoreW"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionOPTIMIZED_TRAJECTORYLAUNCH_COMMAND_ALPHAinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goWow64GetThreadContextWow64SetThreadContextGUIDANCE_VERIFICATIONlink has been severedp" (Indicator: "CryptAcquireContextW"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "itsend on closed channelcall not at safe pointgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitCOMMUNICATION_INTEGRITYdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s" (Indicator: "CertGetCertificateChain"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference ".allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr =" (Indicator: "CertFreeCertificateChain"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative" (Indicator: "CertFreeCertificateContext"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin"), Found api reference "nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unex" (Indicator: "CertCreateCertificateContext"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin"), Found api reference "ut of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "reflect: Elem of invalid type cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usab" (Indicator: "CertAddCertificateContextToStore"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "ut of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "reflect: Elem of invalid type cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usab" (Indicator: "CertVerifyCertificateChainPolicy"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerscomputationalFUEL_ESTIMATESYSTEM_STATUSGRAVITY_FORCEcommunicationlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method span.base()=bad flushGen not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=VirtualAllocExCHARLIE_SIERRABACKUP_RELAY_3ORBIT_ALTI" (Indicator: "CertOpenStore"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionOPTIMIZED_TRAJECTORYLAUNCH_COMMAND_ALPHAinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goWow64GetThreadContextWow64SetThreadContextGUIDANCE_VERIFICATIONlink has been severed" (Indicator: "CertOpenSystemStoreW"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionOPTIMIZED_TRAJECTORYLAUNCH_COMMAND_ALPHAinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goWow64GetThreadContextWow64SetThreadContextGUIDANCE_VERIFICATIONlink has been severed" (Indicator: "CryptAcquireContextW"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "itsend on closed channelcall not at safe pointgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitCOMMUNICATION_INTEGRITYdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime:" (Indicator: "CertGetCertificateChain"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negativ" (Indicator: "CertFreeCertificateContext"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep une" (Indicator: "CertCreateCertificateContext"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin"), Found api reference "ut of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "reflect: Elem of invalid type cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usa" (Indicator: "CertAddCertificateContextToStore"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin") Found api reference "ut of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "reflect: Elem of invalid type cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usa" (Indicator: "CertVerifyCertificateChainPolicy"; File: "1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin"), Found api reference "runtime: sp=abi mismatchwrong timerscomputationalFUEL_ESTIMATESYSTEM_STATUSGRAVITY_FORCEcommunicationlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method span.base()=bad flushGen not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}" (Indicator: "CertOpenStore"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=VirtualAllocExCHARLIE_SIERRABACKUP_RELAY_3ORBIT_ALTITUDEPAYLOAD_STATUSREMAINING_FUELSATELLITE_SYNCORBITAL_PERIODbattery_backupSYSTEM_OPTIMALSYSTEM_NOMINALSYSTEM_MINIMALSYSTEM_FAILUREfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=VirtualAllocExCHARLIE_SIERRABACKUP_RELAY_3ORBIT_ALTITUDEPAYLOAD_STATUSREMAINING_FUELSATELLITE_SYNCORBITAL_PERIODbattery_backupSYSTEM_OPTIMALSYSTEM_NOMINALSYSTEM_MINIMALSYSTEM_FAILUREfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference ", locked to threadruntime.semacreateruntime.semawakeupcommunication_arraybad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionOPTIMIZED_TRAJECTORYLAUNCH_COMMAND_ALPHAinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionOPTIMIZED_TRAJECTORYLAUNCH_COMMAND_ALPHAinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001600.00000000.194330.00191000.00000002.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp")2c:T14c1,Found XOR loop in file "sample.bin" at offset 79024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1811570; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1820772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3027697; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3139636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3462588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 759209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1919211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1919541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1919757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1941487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1945823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1948873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1950043; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1953119; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1956411; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1961171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1961535; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1964115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1966833; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1967633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1971739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1974439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1978729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1984371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1986439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1988249; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1988357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1988705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1989015; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2092927; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2113189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2254167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2265311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2265765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2297693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2298259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2341265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2341411; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2341481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2349097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 161430; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 200871; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 309566; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 354552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 380549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 381245; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 381886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411739; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411786; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 721131; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1188956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1582168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1668344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1671176; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1676144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2107476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2119688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2222946; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2225210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2225600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2244418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2952000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3132736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3161388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3241544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3619468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3621652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3635152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3653008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3685980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3694012; code bytes = 80302d:T4c6,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001600.00000000.194330.6D820000.00000004.mdmp, 00000000-00001600.00000000.194330.6D8C0000.00000004.mdmp")2e:T9f2," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\SysWOW64\\explorer.exe\" launched with commandline \"\" (UID: 00000000-00001156)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DROP Spamhaus DROP Listed Traffic Inbound group 5\" (SID: 2400004, Rev: 4580, Severity: 2) categorized as \"Misc Attack\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/26 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"\"POST /124d0720183846ba.php HTTP/1.1\nContent-Type: application/json\nHost: 45.93.20.34\nContent-Length: 136\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload::==> \"x9pReyeQ0ou5MWgu6PchRPrEvtfnVZEbwyYQnePFyP81yOZceQ8Q/pGIvZpJCdEdNNjzydApsYeA1gqeiVzMiftL+yhUjFH6cfGc8eEX9b0x9qpF2/n9sLff2RoudYbL+52TERdP\" HTTP/1.1 200 OK\nDate: Sun\n 25 Jan 2026 21:14:53 GMT\nServer: Apache/2.4.58 (Ubuntu)\nContent-Length: 64\nKeep-Alive: timeout=5\n max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=UTF-8 with response body ==>782F4955617A5341774E442F505442393650636A41367A41365A4B365170704F68325965752B474B6D4C7834785051584A7739497374797135736B564870383D.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\" x9pReyeQ0ou5MWgu6PchRPrEvtfnVZEbwyYQnePFyP81yOZceQ8Q/pGIvZpJCdEdNNjzydApsYeA1gqeiVzMiftL+yhUjFH6cfGc.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-67","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 45.93.20.34 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\SysWOW64\\explorer.exe\" connects to 45.93.20.34 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n VirtualAlloc\n CreateThread\n GetProcAddress\n LoadLibraryW\n WriteFile\n GetSystemDirectoryA\n LoadLibraryExW\n GetThreadContext","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40b.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"697687aeb138668ac00adaf0"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"