26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 29571eb079c4… — Score 75/100 — Hybrid Analysis","description":"Malicious verdict for sample 29571eb079c4…. Malware family: Win/malicious_confidence_60%. Threat score 75/100. 1/27 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a"],"about":{"@type":"SoftwareApplication","name":"build.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a","additionalType":"Malicious sample"},"threatScore":75,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f6,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin")28:T40b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin")29:T58f8,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125gotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg" (Indicator: "CertOpenStore"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.Typex509negativeserialGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stac" (Indicator: "CryptReleaseContext"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWOrbit altitude (m): Orbital period (s): invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed" (Indicator: "CertOpenSystemStoreW"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWOrbit altitude (m): Orbital period (s): invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed" (Indicator: "CryptAcquireContextW"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "time: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=reflectlite.Value.Type4656612873077392578125unexpected method stepexit hook invoked exitRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultAltitude at max-Q (m): device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/alloc" (Indicator: "CertGetCertificateChain"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "s:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: Total rocket mass (kg): Thrust to weight ratio: === Flight Summary ===Burnout velocity (m/s): connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime:" (Indicator: "CertFreeCertificateChain"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWTotal liftoff thrust (N): First burn delta-v (m/s): invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack t" (Indicator: "CertFreeCertificateContext"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "raceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebMax dynamic pressure (Pa): Second burn delta-v (m/s): channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheaders=== Liftoff Performance ===file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC" (Indicator: "CertCreateCertificateContext"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "nner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type === Target Orbit Parameters ===Combined vehicle delta-v (m/s): resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "nner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type === Target Orbit Parameters ===Combined vehicle delta-v (m/s): resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125gotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxch" (Indicator: "CertOpenStore"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.Typex509negativeserialGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 sta" (Indicator: "CryptReleaseContext"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWOrbit altitude (m): Orbital period (s): invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushe" (Indicator: "CertOpenSystemStoreW"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWOrbit altitude (m): Orbital period (s): invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushe" (Indicator: "CryptAcquireContextW"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "time: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=reflectlite.Value.Type4656612873077392578125unexpected method stepexit hook invoked exitRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultAltitude at max-Q (m): device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allo" (Indicator: "CertGetCertificateChain"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWTotal liftoff thrust (N): First burn delta-v (m/s): invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack" (Indicator: "CertFreeCertificateContext"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheaders=== Liftoff Performance ===file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextG" (Indicator: "CertCreateCertificateContext"; File: "29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin")2a:Tf87,Found XOR loop in file "sample.bin" at offset 89266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 279692; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 743652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 783148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 853357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1292051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2606103; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 556145; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1271623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1342412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1478602; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1516346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1563834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1675962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1727162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1745850; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1776698; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1777098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833018; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1863882; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1870394; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1977146; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000359; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2023626; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2137418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2186570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2230714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2658808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 185878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223689; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224049; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224449; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226611; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 249041; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 269168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 410853; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 988428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1017208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1051912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1051936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1288102; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1313258; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1740415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2314092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2446856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2712808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2770980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2850432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2997862; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3005494; code bytes = 80302b:T775," HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 132 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 30F7E4F2873E459C8122D37D577A8083 Ref B: BY1AA1072319054 Ref C: 2026-06-23T12:46:59Z Date: Tue 23 Jun 2026 12:46:58 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A223437444551706A38484253612B2F54496D572B354A4365755165526B6D354E4D704A575A473368537546....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 271 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: 653579E0F1B143CEA0B9EEF3697E7BB7 Ref B: SJC211051203045 Ref C: 2026-06-23T12:47:09Z Date: Tue 23 Jun 2026 12:47:09 GMT with response body ==>5B7B226E616D65223A226172626974726174696F6E5F7072696F726974795F6C697374222C2275726C223A2268747470733A2F2F656467656173736574736572....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 266 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: 9FE32878E8574442BAF4DC759D5A8FBB Ref B: SJC211051203039 Ref C: 2026-06-23T12:47:09Z Date: Tue 23 Jun 2026 12:47:09 GMT with response body ==>5B7B226E616D65223A22656467655F6875625F617070735F6D616E69666573745F677A222C2275726C223A2268747470733A2F2F656467656173736574736572....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 267 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: 2BC7787290154A77B6395803963217A7 Ref B: SJC211051203039 Ref C: 2026-06-23T12:47:10Z Date: Tue 23 Jun 2026 12:47:09 GMT with response body ==>5B7B226E616D65223A22646F6D61696E735F636F6E6669675F677A222C2275726C223A2268747470733A2F2F656467656173736574736572766963652E617A75....... "GET /abusiveadblocking/api/v1/blocklist HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive If-None-Match: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B" Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd" Response ==> HTTP/1.1 304 Not Modified Cache-Control: public max-age=43200 Content-Type: application/json; charset=utf-8 Content-Encoding: gzip ETag: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B" Vary: Accept-Encoding X-Cache: TCP_HIT X-FALCON-REF: Ref A: 8DCDD34121DD49E0A6D5F1603DC86670 Ref B: SC-WUS2-AAU7H_AKS-GEN02-24517907-VMSS000001_FABRICROUTER-AZUREGLOBALPRIVATE-7B6F57BCF4-FPVPR Ref C: 2026-06-23T06:27:55Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Mesh-Client-TTL: 72 Strict-Transport-Security: max-age=0 X-MSEdge-Ref: Ref A: C891949FA0DA400FAEE9F5FF2E56ECC1 Ref B: BY1AA1072316062 Ref C: 2026-06-23T12:47:11Z Date: Tue 23 Jun 2026 12:47:10 GMT with no response body "GET /v1/eus010/b48fefdb-99cd-422c-ba41-13fb295af2a6/8583123c-12fe-4677-94ef-6a5f294b289f_650.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1, *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US,en;q=0.9 Range: bytes=13565952-13815551 If-Range: "0x8DECBA500F11DEB"" Response ==> HTTP/1.1 206 Partial Content Content-Type: video/mp4 x-ms-request-id: 8aafe380-901e-00a2-3a8f-fde576000000 x-ms-version: 2025-05-05 x-ms-meta-videofiletype: progressive x-ms-creation-time: Tue 16 Jun 2026 12:44:27 GMT x-ms-blob-content-md5: W9zBodSfCx7xw34Jm6Qo3A== x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-ms-access-tier: Hot x-ms-access-tier-inferred: true x-ms-last-access-time: Tue 16 Jun 2026 12:48:25 GMT Access-Control-Allow-Origin: * x-azure-ref: 20260616T130006Z-1777995cd4ftvz7xhC1LAXxa9400000006w000000000hzsh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 rule: eus010 Last-Modified: Tue 16 Jun 2026 12:44:27 GMT ETag: "0x8DECBA500F11DEB" Cache-Control: public max-age=2424363 Date: Tue 23 Jun 2026 12:47:21 GMT Content-Range: bytes 13565952-13815551/13815552 Content-Length: 249600 Connection: keep-alive with response body ==>C2AEC29779C2B34E25C39DC397C3B4C39D21C29AC380240C2FC3ABC39322C2B15FC38A0AC3956CC2BF0CC392C392C2AF0B77C390C3A277C28C7F68C3B85DC3AD....... "GET /REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/5?mapSize=268,136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2 Host: ecn.dev.virtualearth.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Date: Tue 23 Jun 2026 12:47:01 GMT X-Azure-Ref: 20260622T212412Z-r1657646f44q9lgghC1CHIz0g800000009t000000000wk4e X-Bm-Fe-Elapsed: 91 Access-Control-Allow-Headers: Content-Type X-FD-Features X-FD-FLIGHT PreferAnonymous X-Ms-Bm-Ws-Info: 0 X-Bm-Traceid: 3e1b7d5d7413625c3cb47bafa2ca3609 X-Bm-Srv: mapsplatform-frontend-549d9c48ff-sk9c6 mapsplatform-imagery-service-7cd7968c5b-mwzsn Cache-Control: public max-age=17840 Alt-Svc: h3=":443"; ma=93600 h3-29=":443"; ma=93600 Access-Control-Allow-Methods: POST GET OPTIONS Aks_4209_weight: 100 with response body ==>BINARY_CONTENT....... "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 23 Jun 2026 12:47:05 GMT Server: cloudflare X-Li-Fabric: prod-lor1 Cf-Ray: a1039968cfbd5e55-SJC X-Li-Source-Fabric: prod-lva1 Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip Cf-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=31536000 Set-Cookie: __cf_bm=vTHMKi1.Cn987OAph8a4pNPqGqR0UD3ocJQaKY6RBjU-1782218825.0902286-1.0.1.1-ylE3x_ZWD99MkLR9VTWaDGxym4J8jR58kIMzJoMzw3xpDsSRRboazbZhyFK4j1JhXpqonZFwnjtH3hBHKHVd7TjWwsvp9X20fznGaP6aGGODgx0PZ08uzqgWCGQatepc; HttpOnly; SameSite=None; Secure; Path=/; Domain=linkedin.com; Expires=Tue 23 Jun 2026 13:17:05 GMT X-Li-Uuid: AAZU6yf72rMNPDmYUP10RA== Nel: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Content-Type-Options: nosniff X-Li-Pop: cf-prod-lva1-x Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Tue 23 Jun 2026 12:47:05 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940130-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 67488 X-Timer: S1782218825.104017 VS0 VE69 X-Cache: MISS X-Vcl-Time-Ms: 69 Cache-Control: no-cache no-store Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Tue 23 Jun 2026 12:47:06 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=5928053292148862249; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon 21-Sep-2026 12:47:06 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: f1ea31aa-c83b-4d4f-8a5f-f9fa9a93c0c7 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 894.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/octet-stream Date: Tue 23 Jun 2026 12:47:10 GMT Last-Modified: Wed 08 Apr 2026 16:21:07 GMT X-Azure-Ref: 20260623T124710Z-r1b9fb564fcp77mhhC1IADdskg0000000dcg00000000gcwk X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Fd-Int-Roxy-Purgeid: 0 Vary: Accept-Encoding Content-Encoding: br X-Cache: TCP_HIT Cache-Control: public max-age=604800 X-Ms-Request-Id: 1f756834-201e-004b-01fa-fe3692000000 X-Ms-Blob-Type: BlockBlob with no response body "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Tue 23 Jun 2026 12:47:27 GMT X-Azure-Ref: 20260623T124727Z-1557f64bd8b4bnb8hC1IADgx480000000d8000000000688d X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Accept-Ranges: bytes X-Ms-Request-Id: 55b45253-901e-001f-6785-fe0173000000 with no response body "GET /crx/blobs/AcPRoer2Zc8Cgsxh3W97Ool_-PGKhLaIiI3sel8eaYNhRISQxgF7RAU9V6yJvXw1e7sYHW2j6vqLEhEQKXjZoaglbnja3Q65AdkDVIKRv7wFMJgAqud8KltAaV-Hxvg30NwAxlKa5QTua4OZ5Ic-CUkgokgc_Nvmf1Of/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4, i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip, deflate, br, zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AJ5rDhFGPv83pWm5EamLYnyoZyUuemLeVV__UsFwEqpXE_zmxqDxWO12b954sBvCgCcKrCvv Date: Tue 23 Jun 2026 03:24:15 GMT Server: UploadServer Last-Modified: Thu 11 Jun 2026 18:34:52 GMT Expires: Wed 23 Jun 2027 03:24:15 GMT Etag: 0613766b_b05dde31_e4e6f0e1_316fbea1_6bb6e3e5 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 33792 X-Goog-Hash: crc32c=oht2/g== with response body ==>BINARY_CONTENT.......2f:T4bd," "{"request":{"@os":"win","@updater":"msedgecrx","acceptformat":"crx3 download run xz zucc","apps":[{"appid":"jmjflgjpcpepeafmmgdpfkogkghcpiha","cohort":"rrf@0.02","enabled":true,"installdate":6971,"installedby":"other","lang":"en-US","ping":{"ping_freshness":"{9d9e62d6-5520-4108-87f1-23636880fd52}","rd":6971},"targetingattributes":{"AppCohort":"rrf@0.02","AppMajorVersion":"145","AppRollout":0.02,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false},"updatecheck":{},"version":"1.2.1"}],"arch":"x64","dedup":"cr","domainjoined":false,"hw":{"avx":1,"physmemory":8,"sse":1,"sse2":1,"sse3":1,"sse41":1,"sse42":1,"ssse3":1},"ismachine":1,"os":{"arch":"x86_64","platform":"Windows","version":"10.0.16299.248"},"prodversion":"145.0.3800.58","protocol":"4.0","requestid":"{0c7de94e-74af-45a9-b3b0-26107f1e448f}","revocationviaomahaenabled":"0","sessionid":"{9c8a45e1-e3e4-4dd1-9694-430a3ded81f3}","updaterversion":"145.0.3800.58"}}" HTTP/1.1 200 OK Cache-Control: no-store must-revalidate no-cache max-age=0 Pragma: no-cache Content-Length: 161 Content-Type: application/json Content-Encoding: gzip Expires: Mon 01 Jan 1990 00:00:00 GMT X-FALCON-REF: Ref A: BE1060A77A2B43C3AC1B0B0930EE7F82 Ref B: SC-KORS-4ONYK_AKS-GEN10-18679786-VMSS00000E_FABRICROUTER-AZUREGLOBALPRIVATE-7B6F57BCF4-7PXG6 Ref C: 2026-06-23T12:47:27Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Frame-Options: sameorigin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: BE1060A77A2B43C3AC1B0B0930EE7F82 Ref B: SJC211051205035 Ref C: 2026-06-23T12:47:27Z Date: Tue 23 Jun 2026 12:47:26 GMT with response body ==>295D7D270A7B22726573706F6E7365223A7B2270726F746F636F6C223A22342E30222C22736572766572223A2270726F64222C226461797374617274223A7B22....... "POST /chromewebstore/v1.1/items/verify HTTP/2 Host: www.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "{"hash":"1KecGLGopLELrIEY1CV2/FSDOaF1QGFni/MfMfiMujg=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}" HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Tue 23 Jun 2026 12:47:10 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":75,"unified_at_epoch_ms":1790995159069,"unified_at":"2026-10-03T02:39:19.069Z","metadata":{"hashes":{"sha256":"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a","sha1":"a1cbc16e96070d3e8f61322342e04b5e39e37ef7","md5":"c4cc23fb7a38b9891faacc6d69bf0e0d","sha512":"652d424a53201af25a1dc691fd61b6df8ed55798c7f5217e01ad9c3af805f2478bd0d1683d2cfeb3d4dae0b7bcc300ff1ee35ca618878bd24f93c5f60edd8f8a","ssdeep":"49152:RhZ/T6NR3qsRJ+TiK+7TuW0QVzM7AKOgzGwDsfPyFZEIgVj:RhBAV3H70QBY7OgzGwDsfPyFZEx","ssdeep_chunks":["49152:RhZ/T6N","49152:hZ/T6NR","49152:Z/T6NR3","49152:/T6NR3q","49152:T6NR3qs","49152:6NR3qsR","49152:NR3qsRJ","49152:R3qsRJ+","49152:3qsRJ+T","49152:qsRJ+Ti","49152:sRJ+TiK","49152:RJ+TiK+","49152:J+TiK+7","49152:+TiK+7T","49152:TiK+7Tu","49152:iK+7TuW","49152:K+7TuW0","49152:+7TuW0Q","49152:7TuW0QV","49152:TuW0QVz","49152:uW0QVzM","49152:W0QVzM7","49152:0QVzM7A","49152:QVzM7AK","49152:VzM7AKO","49152:zM7AKOg","49152:M7AKOgz","49152:7AKOgzG","49152:AKOgzGw","49152:KOgzGwD","49152:OgzGwDs","49152:gzGwDsf","49152:zGwDsfP","49152:GwDsfPy","49152:wDsfPyF","49152:DsfPyFZ","49152:sfPyFZE","49152:fPyFZEI","49152:PyFZEIg","49152:yFZEIgV","49152:FZEIgVj","98304:RhZ/T6N","98304:hZ/T6NR","98304:Z/T6NR3","98304:/T6NR3q","98304:T6NR3qs","98304:6NR3qsR","98304:NR3qsRJ","98304:R3qsRJ+","98304:3qsRJ+T","98304:qsRJ+Ti","98304:sRJ+TiK","98304:RJ+TiK+","98304:J+TiK+7","98304:+TiK+7T","98304:TiK+7Tu","98304:iK+7TuW","98304:K+7TuW0","98304:+7TuW0Q","98304:7TuW0QV","98304:TuW0QVz","98304:uW0QVzM","98304:W0QVzM7","98304:0QVzM7A","98304:QVzM7AK","98304:VzM7AKO","98304:zM7AKOg","98304:M7AKOgz","98304:7AKOgzG","98304:AKOgzGw","98304:KOgzGwD","98304:OgzGwDs","98304:gzGwDsf","98304:zGwDsfP","98304:GwDsfPy","98304:wDsfPyF","98304:DsfPyFZ","98304:sfPyFZE","98304:fPyFZEI","98304:PyFZEIg","98304:yFZEIgV","98304:FZEIgVj","49152:RhBAV3H","49152:hBAV3H7","49152:BAV3H70","49152:AV3H70Q","49152:V3H70QB","49152:3H70QBY","49152:H70QBY7","49152:70QBY7O","49152:0QBY7Og","49152:QBY7Ogz","49152:BY7OgzG","49152:Y7OgzGw","49152:7OgzGwD","49152:fPyFZEx"],"imphash":"d42595b695fc008ef2c56aabd8efd68e"},"file_info":{"file_name":"build.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":3081608,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1782218674000,"last_seen":1782218680000,"last_multi_scan":1782218680000}},"detections":{"summary":{"verdict":"malicious","score":75,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":67},"sandbox_signatures":{"informative_count":135,"suspicious_count":12,"malicious_count":1,"total":148},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Creates new processes"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a.bin.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$40","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 23.47.72.11\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Creates new processes","description":"\"msedge.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6a3a7fb76efaca45ca08c755"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"